@timber-js/app 0.2.0-alpha.171 → 0.2.0-alpha.173

package/dist/server/internal.js

@@ -1,13 +1,13 @@
-import { a as classifyMetadataRoute, i as METADATA_ROUTE_CONVENTIONS, o as getMetadataRouteAutoLink, r as canonicalize, s as getMetadataRouteServePath } from "../_chunks/canonicalize-Du3o_ptW.js";
+import { a as classifyMetadataRoute, i as METADATA_ROUTE_CONVENTIONS, o as getMetadataRouteAutoLink, r as canonicalize, s as getMetadataRouteServePath } from "../_chunks/canonicalize-DQHyFClh.js";
 import { n as classifyUrlSegment } from "../_chunks/segment-classify-Byy425ng.js";
-import { $ as timingAls, A as setMatchedSegmentPath, C as applyRequestHeaderOverlay, D as getSegmentParams, E as getSearchParams, F as getSetCookieHeaders, G as replaceTraceId, H as getOtelTraceId, I as getWaitUntil, J as withSpan, K as runWithTraceId, L as isDebug, M as setSegmentParams, N as getCookie, O as markResponseFlushed, V as generateTraceId, W as getTraceId, Y as earlyHintsSenderAls, Z as requestContextAls, _ as RedirectSignal, a as logProxyError, c as logRequestReceived, d as logSwrRefetchFailed, f as logWaitUntilRejected, g as DenySignal, h as swallow, i as logMiddlewareShortCircuit, j as setMutableCookieContext, k as runWithRequestContext, l as logRouteError, m as setLogger, n as logCacheMiss, o as logRenderError, p as logWaitUntilUnsupported, q as setSpanAttribute, r as logMiddlewareError, s as logRequestCompleted, t as getLogger, u as logSlowRequest, v as RenderError, w as getHeader } from "../_chunks/logger-AWfuX-KJ.js";
-import { i as coerce, t as executeAction } from "../_chunks/actions-O_LsyCE4.js";
-import { a as getManifestEntry, b as wasInvalidatedSince, c as lookupPrebuiltPayload, d as checkVersionSkew, i as storeOverlayEntry, l as setPrebuiltPayloadSource, n as lookupOverlay, o as hasPrebuiltPayloadSource, r as overlayKey, s as isParamIndependent, u as applyReloadHeaders, v as currentInvalidationEpoch, x as createSingleflight, y as lastInvalidationEpochFor } from "../_chunks/cache-api-B-lhk9p4.js";
+import { $ as timingAls, A as setMatchedSegmentPath, C as applyRequestHeaderOverlay, D as getSegmentParams, E as getSearchParams, F as getSetCookieHeaders, G as replaceTraceId, H as getOtelTraceId, I as getWaitUntil, J as withSpan, K as runWithTraceId, L as isDebug, M as setSegmentParams, N as getCookie, O as markResponseFlushed, V as generateTraceId, W as getTraceId, Y as earlyHintsSenderAls, Z as requestContextAls, _ as RedirectSignal, a as logProxyError, c as logRequestReceived, d as logSwrRefetchFailed, f as logWaitUntilRejected, g as DenySignal, h as swallow, i as logMiddlewareShortCircuit, j as setMutableCookieContext, k as runWithRequestContext, l as logRouteError, m as setLogger, n as logCacheMiss, o as logRenderError, p as logWaitUntilUnsupported, q as setSpanAttribute, r as logMiddlewareError, s as logRequestCompleted, t as getLogger, u as logSlowRequest, v as RenderError, w as getHeader } from "../_chunks/logger-kUT0QH0K.js";
+import { i as coerce, t as executeAction } from "../_chunks/actions-pN8r5Vnh.js";
+import { a as getManifestEntry, b as wasInvalidatedSince, c as lookupPrebuiltPayload, d as checkVersionSkew, i as storeOverlayEntry, l as setPrebuiltPayloadSource, n as lookupOverlay, o as hasPrebuiltPayloadSource, r as overlayKey, s as isParamIndependent, u as applyReloadHeaders, v as currentInvalidationEpoch, x as createSingleflight, y as lastInvalidationEpochFor } from "../_chunks/cache-api-2hT5kfsr.js";
 import "../client/error-boundary.js";
 import { n as toBracketKey } from "../_chunks/resolve-schema-Dz3fcFUo.js";
 import "../_chunks/segment-context-ZDnXDkbz.js";
-import { readFile } from "node:fs/promises";
 import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
 import React, { createElement, useContext } from "react";
 //#region src/server/server-timing.ts
 /**
@@ -1500,7 +1500,13 @@ async function accessGateFallback(accessFn, segmentName, denyPages, children) {
 * slot doesn't make architectural sense.
 */
 async function SlotAccessGate(props) {
-	const { accessFn, DeniedComponent, slotName, createElement, defaultFallback, children } = props;
+	const { accessFn, DeniedComponent, slotName, createElement, defaultFallback, children, verdict } = props;
+	if (verdict !== void 0) {
+		if (verdict === "pass") return children;
+		if (verdict instanceof DenySignal) return buildDeniedFallback(DeniedComponent, slotName, verdict.data, createElement) ?? defaultFallback ?? null;
+		if (isDebug()) console.error("[timber] redirect() is not allowed in slot access.ts. Slots use deny() for graceful degradation — denied.tsx → default.tsx → null. If you need to redirect, move the logic to the parent segment's access.ts.");
+		return buildDeniedFallback(DeniedComponent, slotName, void 0, createElement) ?? defaultFallback ?? null;
+	}
 	try {
 		await accessFn();
 	} catch (error) {
@@ -1526,1921 +1532,1862 @@ function buildDeniedFallback(DeniedComponent, slotName, data, createElement) {
 	});
 }
 //#endregion
-//#region src/server/param-coercion.ts
-/** Global schema codecs, set once at startup from virtual:timber-schema. */
-var _globalCodecs = null;
+//#region src/client/slot-context.ts
 /**
-* Run segment param coercion on the matched route's segments.
-*
-* When `globalCodecs` is provided (from app/schema.ts), uses the global
-* codec map keyed by bare param name. Otherwise falls back to loading
-* per-segment params.ts modules.
+* SlotContext — delivers live slot content to SlotOutlet holes inside
+* cached component shells (TIM-1173).
 *
-* Throws ParamCoercionError if any codec fails (→ 404).
+* A `cache.component(Fn, { slots: [...] })` shell is captured with a
+* stable <SlotOutlet slot={name} /> client reference in place of each
+* declared slot prop. At request time the revived shell is wrapped in a
+* SlotsProvider carrying the live slot values; each outlet reads its
+* value from this context by name.
 *
-* This runs BEFORE middleware, so ctx.segmentParams is already typed.
-* See design/07-routing.md §"Where Coercion Runs"
-* See design/41-global-params.md §"Pipeline Integration"
-*/
-async function coerceSegmentParams(match) {
-	const globalCodecs = _globalCodecs;
-	const mergeTarget = Object.create(null);
-	for (const key of Object.keys(match.segmentParams)) if (key !== "__proto__") mergeTarget[key] = match.segmentParams[key];
-	match.segmentParams = mergeTarget;
-	if (globalCodecs) {
-		for (const segment of match.segments) {
-			if (!segment.paramName) continue;
-			const bracketKey = toBracketKey(segment.segmentType, segment.paramName);
-			const codec = globalCodecs[bracketKey];
-			if (!codec) continue;
-			const key = segment.paramName;
-			if (!(key in mergeTarget)) continue;
-			try {
-				mergeTarget[key] = sanitizeParamValue(codec.parse(mergeTarget[key]));
-			} catch (err) {
-				const message = err instanceof Error ? err.message : String(err);
-				if (isDebug()) console.warn(`[timber] Global schema codec rejected value for param "${key}"\n  Error: ${message}\n  Raw value: ${JSON.stringify(mergeTarget[key])}\n  Hint: check the codec in app/schema.ts for key '${bracketKey}'.`);
-				throw new ParamCoercionError(message);
-			}
-		}
-		return;
-	}
-	for (const segment of match.segments) {
-		if (!segment.params) continue;
-		let mod;
-		try {
-			mod = await loadModule(segment.params);
-		} catch (err) {
-			const message = `Failed to load params module for segment "${segment.segmentName}": ${err instanceof Error ? err.message : String(err)}`;
-			if (isDebug()) console.warn(`[timber] Param coercion error: ${message}\n  Segment: ${segment.segmentName}\n  Params file: ${segment.params}`);
-			throw new ParamCoercionError(message);
-		}
-		const segmentParamsDef = mod.segmentParams;
-		if (!segmentParamsDef || typeof segmentParamsDef.parse !== "function") continue;
-		try {
-			const coerced = segmentParamsDef.parse(match.segmentParams);
-			for (const key of Object.keys(coerced)) if (key !== "__proto__") mergeTarget[key] = sanitizeParamValue(coerced[key]);
-		} catch (err) {
-			const message = err instanceof Error ? err.message : String(err);
-			if (isDebug()) {
-				const rawKeys = Object.keys(match.segmentParams).join(", ");
-				console.warn(`[timber] Param codec rejected values for segment "${segment.segmentName}"\n  Error: ${message}\n  Available raw params: { ${rawKeys} }\n  Params file: ${segment.params}\n  Hint: this usually means a codec threw for the raw URL value.\n  Check that the regex/schema accepts the actual path segment string.`);
-			}
-			throw new ParamCoercionError(message);
-		}
-	}
-}
-//#endregion
-//#region src/client/segment-update-context.ts
-/**
-* SegmentUpdateContext — React context for partial navigation updates.
+* Providers MERGE per-key with their parent: an inner SlotsProvider
+* inherits the outer's values and overrides only the keys it declares.
+* Two sibling instances each have their own provider and resolve
+* independently. Layouts use a reserved slot name (LAYOUT_CHILDREN_SLOT)
+* that cannot collide with user-declared slot names (TIM-1191).
 *
-* During partial navigation (server skips unchanged sync layouts), the
-* router builds a Map of segment path → ReactNode updates and passes it
-* as the context value. Mounted SegmentOutlet components read from this
-* context to decide whether to render the update or their cached content.
+* Generalizes the original layout children pattern (TIM-1181) from a
+* single implicit `children` hole on layouts to explicitly declared,
+* named slot props on any cached component. Layouts use this same
+* context with the reserved LAYOUT_CHILDREN_SLOT key (TIM-1191).
 *
-* SINGLETON GUARANTEE: Uses globalThis + Symbol.for — same pattern as
-* NavigationContext. The RSC client bundler can duplicate this module
-* across chunks (browser-entry graph + client-reference graph). With
-* ESM output, each chunk gets its own module scope — a bare createContext
-* at module level would create separate instances per chunk. globalThis
-* guarantees a single instance regardless of duplication.
+* SINGLETON GUARANTEE: globalThis + Symbol.for — the RSC client bundler
+* can duplicate this module across chunks; globalThis guarantees a single
+* context instance.
 *
-* See design/19-client-navigation.md §"Singleton Guarantee via globalThis"
+* See design/45-cache-lifetimes.md §Slot Components.
 */
-var EMPTY_SEGMENT_UPDATES = /* @__PURE__ */ new Map();
-var CTX_KEY$2 = Symbol.for("__timber_segment_update_ctx");
-function getOrCreateContext$2() {
-	const existing = globalThis[CTX_KEY$2];
+var CTX_KEY$1 = Symbol.for("__timber_slot_ctx");
+function getOrCreateContext$1() {
+	const existing = globalThis[CTX_KEY$1];
 	if (existing !== void 0) return existing;
 	if (typeof React.createContext === "function") {
-		const ctx = React.createContext(EMPTY_SEGMENT_UPDATES);
-		globalThis[CTX_KEY$2] = ctx;
+		const ctx = React.createContext(null);
+		globalThis[CTX_KEY$1] = ctx;
 		return ctx;
 	}
 }
-getOrCreateContext$2();
+var SlotContext = getOrCreateContext$1();
 //#endregion
-//#region src/client/segment-outlet.tsx
+//#region src/client/slot-outlet.tsx
 /**
-* SegmentOutlet — client component boundary at each layout segment.
-*
-* Each layout in the segment tree is wrapped with a SegmentOutlet that:
-* 1. Knows its segment path (prop from the server)
-* 2. Reads from SegmentUpdateContext for partial navigation updates
-* 3. Caches its rendered content in a ref across navigations
-*
-* On full navigation: receives new children via props, caches and renders them.
-* On partial navigation (this segment skipped): the context map has no entry
-* for this path, so the outlet returns cached content — preserving layout state.
-* On partial navigation (this segment updated): the context map has content
-* for this path, so the outlet renders the update.
+* SlotOutlet — the hole in a cached component shell (TIM-1173).
 *
-* Uses React context instead of useSyncExternalStore to stay compatible
-* with concurrent rendering (transitions). All outlets re-render when the
-* context value changes, but each bails out quickly if its segment has
-* no update — same approach as Next.js LayoutRouter.
+* At capture time the prebuilt runtime renders the wrapped component with
+* <SlotOutlet slot={name} /> in place of each declared slot prop. Being a
+* client component, it serializes into the flight payload as a stable,
+* deterministic client reference — the same bytes regardless of what live
+* content will fill the hole. At request time the revived shell sits under
+* a SlotsProvider and each outlet reads its live value from SlotContext.
 *
-* Security: performance optimization only. The server always runs all
-* access.ts files regardless of segment skipping.
-* See design/13-security.md §"State tree manipulation".
+* See design/45-cache-lifetimes.md §Slot Components.
 */
+function SlotOutlet({ slot }) {
+	const values = useContext(SlotContext);
+	return values ? values[slot] ?? null : null;
+}
 //#endregion
-//#region src/client/child-segment-context.ts
+//#region src/client/slot-provider.tsx
 /**
-* ChildSegmentContext — delivers child segment content to ChildSegmentOutlet.
-*
-* Each layout receives a stable <ChildSegmentOutlet /> client reference as
-* its `children` prop instead of varying server content. The actual child
-* content (page or inner layout) is provided via this context from a
-* ChildSegmentProvider placed ABOVE the layout in the element tree.
+* SlotsProvider — wraps a revived cached shell to supply live slot content
+* to the SlotOutlet holes inside it (TIM-1173).
 *
-* This structural separation is what makes layout cache.component hits
-* possible: the cached layout payload contains a deterministic client
-* reference as children, not the varying inner content that changes per
-* route. Same pattern as Next.js LayoutRouter.
+* Values MERGE with the nearest parent provider so that nesting a
+* cache.component SlotsProvider inside a layout SlotsProvider preserves
+* the layout's `children` slot while adding the component's own slots.
+* Inner values override outer ones with the same name (spread order).
 *
-* SINGLETON GUARANTEE: Uses globalThis + Symbol.for — same pattern as
-* SegmentUpdateContext. The RSC client bundler can duplicate this module
-* across chunks; globalThis guarantees a single context instance.
+* Tree structure per cached-component instance:
+*   SlotsProvider(values={children: <Live />})
+*     └── revived shell
+*          └── SlotOutlet(slot="children") → reads context → <Live />
 *
-* See design/45-cache-lifetimes.md §Layout Propagation.
+* See design/45-cache-lifetimes.md §Slot Components.
 */
-var CTX_KEY$1 = Symbol.for("__timber_child_segment_ctx");
-function getOrCreateContext$1() {
-	const existing = globalThis[CTX_KEY$1];
-	if (existing !== void 0) return existing;
-	if (typeof React.createContext === "function") {
-		const ctx = React.createContext(null);
-		globalThis[CTX_KEY$1] = ctx;
-		return ctx;
-	}
+function SlotsProvider({ values, children }) {
+	const parent = useContext(SlotContext);
+	const merged = parent ? {
+		...parent,
+		...values
+	} : values;
+	return createElement(SlotContext.Provider, { value: merged }, children);
 }
-var ChildSegmentContext = getOrCreateContext$1();
 //#endregion
-//#region src/client/child-segment-outlet.tsx
+//#region src/server/prebuilt/cache-key.ts
 /**
-* ChildSegmentOutlet — renders child segment content from context.
-*
-* Passed as `children` to every layout component, replacing the previous
-* pattern of passing rendered server content directly. The layout receives
-* a stable client reference (this component), and the actual child content
-* is delivered via ChildSegmentContext from a provider above the layout.
+* Component cache-key hashing for prebuilt (cache.component) entries.
 *
-* This makes layout cache.component hits possible: the cached layout
-* payload contains this deterministic client reference, not varying
-* server content. On cache hit, the revived payload contains the layout
-* shell + this outlet; the provider above supplies the current request's
-* child content.
+* Key: `sha256(canonicalJson({ props, params })).slice(0, 16)` — see
+* design/44-render-at-build-time.md §Cache Key. Both the request-time
+* lookup (prebuilt-runtime.ts) and the post-build capture pass (TIM-1119)
+* MUST use this exact function, or build artifacts become unaddressable.
 *
-* See design/45-cache-lifetimes.md §Layout Propagation.
-*/
-function ChildSegmentOutlet() {
-	return useContext(ChildSegmentContext);
-}
-//#endregion
-//#region src/client/child-segment-provider.tsx
-/**
-* ChildSegmentProvider — wraps a layout to provide child segment content.
+* THE IDENTITY CONTRACT (design/44 §Cache Key): cache identity is **JSON
+* value semantics** — two inputs are the same entry iff they are the same
+* JSON value. This is an ALLOWLIST, not a denylist: a value participates
+* in caching iff it is plain JSON data — null, boolean, finite number,
+* string, dense array, or a plain `Object.prototype` object with only
+* enumerable string-keyed data properties — plus `undefined` and `-0`,
+* which hash as distinct sentinels because flight preserves them. Every
+* value outside that domain (functions, symbols, bigints, accessors,
+* hidden or symbol-keyed properties, non-`Object.prototype` prototypes
+* including null, aliased references, sparse arrays, cycles, non-finite
+* numbers) is UNKEYABLE by definition: `computeComponentCacheKey` returns
+* null and the caller renders live — slower, never wrong.
 *
-* Placed above the layout in the element tree so that ChildSegmentOutlet
-* (inside the layout's `children`) can read the actual child content.
+* The line between rejected and declared-out-of-domain: values are
+* REJECTED when the JSON projection itself would be ambiguous or lossy
+* (hidden/symbol/non-enumerable properties, accessors, exotic
+* prototypes). Observable state that leaves the projection intact — key
+* order, reference identity, descriptor metadata (writable/configurable,
+* frozen/sealed/extensible), proxy behavior — is DECLARED outside
+* cache.component's supported input domain rather than rejected:
+* key-order insensitivity is required for determinism, and rejecting
+* frozen objects would unkey ubiquitous legitimate inputs
+* (Object.freeze'd config props) to defend against components that
+* render differently based on property attributes.
 *
-* Tree structure:
-*   ChildSegmentProvider(childContent=innerElement)
-*     └── Layout(children=<ChildSegmentOutlet />)
-*          └── ChildSegmentOutlet → reads context → innerElement
+* Two hard rules for this walk itself: it must be TOTAL (never throw
+* anything but UnkeyableValueError) and SIDE-EFFECT-FREE (descriptor
+* reads only; never invoke user code such as getters).
 *
-* See design/45-cache-lifetimes.md §Layout Propagation.
+* Object keys sort recursively so `{a, b}` and `{b, a}` hash identically
+* (design/13-security.md checklist #14 — cache key determinism; key order
+* is deliberately NOT part of identity).
 */
-//#endregion
-//#region src/server/route-element-builder.ts
+var UnkeyableValueError = class extends Error {};
+function canonicalize$1(value, seen) {
+	if (value === null) return "null";
+	switch (typeof value) {
+		case "string": return JSON.stringify(value);
+		case "boolean": return value ? "true" : "false";
+		case "number":
+			if (!Number.isFinite(value)) throw new UnkeyableValueError("non-finite number");
+			return Object.is(value, -0) ? "-0" : String(value);
+		case "object": break;
+		case "undefined": return "undefined";
+		default: throw new UnkeyableValueError(`unsupported type: ${typeof value}`);
+	}
+	const obj = value;
+	if (seen.has(obj)) throw new UnkeyableValueError("repeated object reference (cycle or alias)");
+	seen.add(obj);
+	if (Object.getOwnPropertySymbols(obj).length > 0) throw new UnkeyableValueError("symbol-keyed property");
+	{
+		if (Array.isArray(obj)) {
+			if (Object.getOwnPropertyNames(obj).length !== obj.length + 1) throw new UnkeyableValueError("non-index array property");
+			const parts = [];
+			for (let i = 0; i < obj.length; i++) {
+				const desc = Object.getOwnPropertyDescriptor(obj, i);
+				if (desc === void 0) throw new UnkeyableValueError("sparse array hole");
+				if (desc.get !== void 0 || desc.set !== void 0) throw new UnkeyableValueError("accessor property");
+				if (!desc.enumerable) throw new UnkeyableValueError("non-enumerable array element");
+				parts.push(canonicalize$1(desc.value, seen));
+			}
+			return "[" + parts.join(",") + "]";
+		}
+		if (Object.getPrototypeOf(obj) !== Object.prototype) throw new UnkeyableValueError("non-plain object");
+		const keys = Object.keys(obj).sort();
+		if (keys.length !== Object.getOwnPropertyNames(obj).length) throw new UnkeyableValueError("non-enumerable property");
+		const parts = [];
+		for (const key of keys) {
+			const desc = Object.getOwnPropertyDescriptor(obj, key);
+			if (desc.get !== void 0 || desc.set !== void 0) throw new UnkeyableValueError("accessor property");
+			parts.push(JSON.stringify(key) + ":" + canonicalize$1(desc.value, seen));
+		}
+		return "{" + parts.join(",") + "}";
+	}
+}
 /**
-* Thrown when a defineSegmentParams codec's parse() fails.
-* The pipeline catches this and responds with 404.
+* Canonicalize a single value, or null if it is unkeyable. The ONE
+* definition of "faithfully comparable" — every prebuilt code path that
+* needs value equality (cache keys, slot-param divergence) goes through
+* this, so the unkeyable rules (accessors, hidden props, aliases,
+* bigints, …) live in exactly one place.
 */
-var ParamCoercionError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "ParamCoercionError";
+function tryCanonicalize(value) {
+	try {
+		return canonicalize$1(value, /* @__PURE__ */ new Set());
+	} catch (error) {
+		return toUnkeyable(error);
 	}
-};
-//#endregion
-//#region src/server/pipeline-metadata.ts
+}
 /**
-* Metadata route helpers for the request pipeline.
-*
-* Handles serving static metadata files and serializing sitemap responses.
-* Extracted from pipeline.ts to keep files under 500 lines.
-*
-* See design/16-metadata.md §"Metadata Routes"
-*/
-/**
-* Content types that are text-based and should include charset=utf-8.
-* Binary formats (images) should not include charset.
+* Totality by construction: ANY throw from the walk means the input is
+* outside the keyable domain. The walk touches only user-controlled
+* values through reflection ops — and a Proxy trap can throw arbitrary
+* errors from any of them (codex review on PR #835) — so converting only
+* UnkeyableValueError would let hostile/exotic inputs abort a render
+* that plain live rendering would have served fine. Unexpected error
+* types are logged for visibility (they would indicate either a proxy
+* trap or a canonicalizer bug) but still degrade to unkeyable.
 */
-var TEXT_CONTENT_TYPES = /* @__PURE__ */ new Set([
-	"application/xml",
-	"text/plain",
-	"application/json",
-	"application/manifest+json",
-	"image/svg+xml"
-]);
+function toUnkeyable(error) {
+	if (!(error instanceof UnkeyableValueError)) console.error("[timber] cache key canonicalization threw — treating input as unkeyable:", error);
+	return null;
+}
 /**
-* Serve a static metadata file by reading it from disk.
+* Split a props record into data props (participate in the cache key) and
+* slot values (React-element holes, excluded from the key) per the
+* component's declared `slots` option (TIM-1173).
 *
-* Static metadata route files (.xml, .txt, .json, .png, .ico, .svg, etc.)
-* are served as-is with the appropriate Content-Type header.
-* Text files include charset=utf-8; binary files do not.
+* Every DECLARED slot lands in `slotValues` — present or not — because the
+* capture render always injects a SlotOutlet placeholder for each declared
+* slot: the cached shell is identical whether the caller passed the slot
+* or omitted it, so slot presence must not vary the key. `dataProps` is
+* everything else and is what gets hashed.
 *
-* See design/16-metadata.md §"Metadata Routes"
+* Returns null when the props OBJECT itself is outside the identity
+* contract at the top level — accessors, symbol-keyed or non-enumerable
+* properties, or a non-`Object.prototype` prototype. Splitting such an
+* object would normalize away observable state (and reading an accessor
+* would invoke user code, which this walk must never do) BEFORE
+* `computeComponentCacheKey` gets the chance to reject it — a cached
+* shell could then be served for inputs a live render distinguishes.
+* Null means unkeyable: the caller renders live with the original props.
+* The walk is descriptor-reads only; getters are never invoked. Nested
+* data-prop values still face the full allowlist when hashed.
 */
-async function serveStaticMetadataFile(metaMatch) {
-	const { contentType, file } = metaMatch;
-	const isText = TEXT_CONTENT_TYPES.has(contentType);
-	const body = await readFile(file.filePath);
-	const headers = {
-		"Content-Type": isText ? `${contentType}; charset=utf-8` : contentType,
-		"Content-Length": String(body.byteLength),
-		"Cache-Control": "public, max-age=14400, must-revalidate"
-	};
-	return new Response(body, {
-		status: 200,
-		headers
+/** Create an own enumerable data property — safe for keys like `__proto__`. */
+function defineOwn(target, key, value) {
+	Object.defineProperty(target, key, {
+		value,
+		enumerable: true,
+		writable: true,
+		configurable: true
 	});
 }
-/**
-* Serialize a sitemap array to XML.
-* Follows the sitemap.org protocol: https://www.sitemaps.org/protocol.html
-*/
-function serializeSitemap(entries) {
-	return `<?xml version="1.0" encoding="UTF-8"?>\n<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">\n${entries.map((e) => {
-		let xml = `  <url>\n    <loc>${escapeXml(e.url)}</loc>`;
-		if (e.lastModified) {
-			const date = e.lastModified instanceof Date ? e.lastModified.toISOString() : e.lastModified;
-			xml += `\n    <lastmod>${escapeXml(date)}</lastmod>`;
+function splitSlotProps(props, slots) {
+	try {
+		if (Object.getPrototypeOf(props) !== Object.prototype) return null;
+		if (Object.getOwnPropertySymbols(props).length > 0) return null;
+		const slotSet = new Set(slots);
+		const dataProps = {};
+		const slotValues = {};
+		for (const key of Object.getOwnPropertyNames(props)) {
+			const desc = Object.getOwnPropertyDescriptor(props, key);
+			if (desc === void 0 || desc.get !== void 0 || desc.set !== void 0 || !desc.enumerable) return null;
+			defineOwn(slotSet.has(key) ? slotValues : dataProps, key, desc.value);
 		}
-		if (e.changeFrequency) xml += `\n    <changefreq>${escapeXml(e.changeFrequency)}</changefreq>`;
-		if (e.priority !== void 0) xml += `\n    <priority>${e.priority}</priority>`;
-		xml += "\n  </url>";
-		return xml;
-	}).join("\n")}\n</urlset>`;
-}
-/** Escape special XML characters. */
-function escapeXml(str) {
-	return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+		for (const slot of slotSet) if (!Object.hasOwn(slotValues, slot)) defineOwn(slotValues, slot, void 0);
+		return {
+			dataProps,
+			slotValues
+		};
+	} catch (error) {
+		return toUnkeyable(error);
+	}
 }
-//#endregion
-//#region src/server/pipeline-interception.ts
-/**
-* Interception route matching for the request pipeline.
-*
-* Matches target URLs against interception rewrites to support the
-* modal route pattern (soft navigation intercepts).
-*
-* Extracted from pipeline.ts to keep files under 500 lines.
-*
-* See design/07-routing.md §"Intercepting Routes"
-*/
 /**
-* Check if a pathname starts with a prefix on a segment boundary.
+* Compute the cache-entry hash for a component render:
+* `sha256({props, params}).slice(0, 16)` over canonical JSON.
 *
-* Prevents /feed from matching /feed-private — the prefix must be
-* followed by '/' or be an exact match.
+* Returns null when props (or params) contain unkeyable values — the
+* caller must fall back to dynamic rendering.
 */
-function hasSegmentPrefix(pathname, prefix) {
-	if (prefix === "/") return true;
-	if (!pathname.startsWith(prefix)) return false;
-	return pathname.length === prefix.length || pathname[prefix.length] === "/";
+function computeComponentCacheKey(props, params) {
+	let canonical;
+	try {
+		const seen = /* @__PURE__ */ new Set();
+		canonical = "{\"params\":" + canonicalize$1({ ...params }, seen) + ",\"props\":" + canonicalize$1(props, seen) + "}";
+	} catch (error) {
+		return toUnkeyable(error);
+	}
+	return createHash("sha256").update(canonical).digest("hex").slice(0, 16);
 }
 /**
-* Check if an intercepting route applies for this soft navigation.
+* Is this value the framework-injected layout children slot outlet
+* (`<SlotOutlet slot={LAYOUT_CHILDREN_SLOT} />`)? Layout components
+* receive this as their `children` prop — a stable client reference
+* whose cache key is stripped so layout `cache.component` hits work
+* (design/45 §Layout Propagation).
 *
-* Matches the target pathname against interception rewrites, constrained
-* by the source URL (X-Timber-URL header — where the user navigates FROM).
+* Uses a framework-reserved slot name (LAYOUT_CHILDREN_SLOT) that
+* cannot collide with user-declared slot names, preventing context
+* shadowing when a cached component with its own SlotsProvider is
+* nested inside a layout. See TIM-1191.
 *
-* Returns the source pathname to re-match if interception applies, or null.
+* Total: the probes run against a user-controlled value, and a Proxy
+* trap can throw — that must classify as "not the outlet" (the
+* canonicalizer then rejects the value as unkeyable → live render), not
+* abort the request (codex P2 on PR #890).
 */
-function findInterceptionMatch(targetPathname, sourceUrl, rewrites) {
-	for (const rewrite of rewrites) {
-		if (!hasSegmentPrefix(sourceUrl, rewrite.interceptingPrefix)) continue;
-		if (pathnameMatchesPattern(targetPathname, rewrite.interceptedPattern)) return { sourcePathname: rewrite.interceptingPrefix };
+function isChildrenSlotOutletElement(value) {
+	try {
+		if (value == null || typeof value !== "object") return false;
+		if (!("type" in value)) return false;
+		const el = value;
+		return el.type === SlotOutlet && el.props?.slot === "\0timber:children";
+	} catch {
+		return false;
 	}
-	return null;
 }
 /**
-* Check if a pathname matches a URL pattern with dynamic segments.
-*
-* Supports [param] (single segment) and [...param] (one or more segments).
-* Static segments must match exactly.
+* Dense array of non-empty strings — no holes, no non-string entries.
+* Total: the reads run against a user-controlled value at module load,
+* and a throwing Proxy trap must classify as invalid, not crash startup.
 */
-function pathnameMatchesPattern(pathname, pattern) {
-	const pathParts = pathname === "/" ? [] : pathname.slice(1).split("/");
-	const patternParts = pattern === "/" ? [] : pattern.slice(1).split("/");
-	let pi = 0;
-	for (let i = 0; i < patternParts.length; i++) {
-		const seg = classifyUrlSegment(patternParts[i]);
-		switch (seg.kind) {
-			case "catch-all": return pi < pathParts.length;
-			case "optional-catch-all": return true;
-			case "dynamic": {
-				if (pi >= pathParts.length) return false;
-				const prefix = seg.prefix ?? "";
-				const suffix = seg.suffix ?? "";
-				const pathPart = pathParts[pi];
-				if (prefix || suffix) {
-					if (pathPart.length <= prefix.length + suffix.length || prefix && !pathPart.startsWith(prefix) || suffix && !pathPart.endsWith(suffix)) return false;
-				}
-				pi++;
-				continue;
-			}
-			case "static":
-				if (pi >= pathParts.length || pathParts[pi] !== seg.value) return false;
-				pi++;
-				continue;
+function isDenseStringArray(value) {
+	try {
+		if (!Array.isArray(value)) return false;
+		for (let i = 0; i < value.length; i++) {
+			if (!Object.hasOwn(value, i)) return false;
+			const entry = value[i];
+			if (typeof entry !== "string" || entry.length === 0) return false;
 		}
+		return true;
+	} catch {
+		return false;
 	}
-	return pi === pathParts.length;
 }
-//#endregion
-//#region src/server/pipeline-outcome.ts
 /**
-* Pipeline outcome translator — converts a `PhaseOutcome` (the value
-* each phase function returns) into a final `Response`.
-*
-* Lifted out of `pipeline-phases.ts` (TIM-853) so the per-phase try /
-* catch logic and the terminal Response-building logic each live in
-* their own file. The phases produce values; this module is the single
-* source of truth for how those values become wire responses.
-*
-* See design/07-routing.md §"Request Lifecycle".
+* Validate the `slots` option. Both the production and dev wrappers gate
+* on this — slot substitution is active in dev exactly when it would be
+* active in production, so the tree shape a component sees never
+* diverges between the two.
 */
-function rscErrorResponse(isRsc, status, headers) {
-	if (!isRsc) return new Response(null, { status });
-	const h = headers ?? new Headers();
-	h.set("X-Timber-Error", "1");
-	h.set("content-type", "application/json; charset=utf-8");
-	return new Response(JSON.stringify({
-		error: true,
-		status
-	}), {
-		status,
-		headers: h
-	});
+function resolveSlotNames(id, options) {
+	const slots = options.slots;
+	if (slots === void 0) return { kind: "none" };
+	if (!isDenseStringArray(slots)) {
+		console.warn(`[timber] cache.component "${id}": invalid slots declaration — expected an array of non-empty prop-name strings. Slot caching is disabled.`);
+		return { kind: "disabled" };
+	}
+	if (slots.length === 0) return { kind: "none" };
+	if (!(options.ttl !== void 0 || options.tags != null)) {
+		console.warn(`[timber] cache.component "${id}": slots require a runtime lifetime (ttl and/or tags). Slot caching is disabled.`);
+		return { kind: "disabled" };
+	}
+	return {
+		kind: "active",
+		slots
+	};
 }
 /**
-* Terminal outcome handler — converts a `PhaseOutcome` into a final
-* `Response`, applying cookies, building redirects, rendering deny pages
-* and fallback error pages, and firing instrumentation hooks.
+* Split the live props into the cacheable shell render (data props plus a
+* deterministic SlotOutlet placeholder per declared slot — identical
+* whether or not the caller passed the slot) and the per-instance live
+* slot values.
 *
-* This is the single source of truth for how phase outputs become wire
-* responses; the per-phase try/catch blocks now produce values, not
-* Responses, so the conversion logic lives in exactly one place.
+* Null when the props object itself is unkeyable at the top level
+* (accessors, hidden properties, exotic prototype — see splitSlotProps):
+* the caller must render live with the original props.
 */
-async function outcomeToResponse(config, outcome, ctx) {
-	switch (outcome.kind) {
-		case "response": {
-			const finalResponse = cloneWithMutableHeaders(outcome.response);
-			if (outcome.phase === "proxy") return finalResponse;
-			if (outcome.phase === "middleware" && ctx.responseHeaders) {
-				applyCookieJar(finalResponse.headers);
-				mergeMissingHeaders(finalResponse.headers, ctx.responseHeaders);
-				logMiddlewareShortCircuit({
-					method: ctx.method,
-					path: ctx.path,
-					status: finalResponse.status
-				});
+function prepareSlotRender(props, slots) {
+	const split = splitSlotProps(props ?? {}, slots);
+	if (split === null) return null;
+	const { dataProps, slotValues } = split;
+	const shellProps = { ...dataProps };
+	for (const slot of slots) Object.defineProperty(shellProps, slot, {
+		value: createElement(SlotOutlet, { slot }),
+		enumerable: true,
+		writable: true,
+		configurable: true
+	});
+	return {
+		shellProps,
+		dataProps,
+		slotValues
+	};
+}
+/**
+* Wrap a rendered shell (revived payload or live element) in a
+* per-instance SlotsProvider feeding the live values to its outlets.
+*/
+function wrapInSlotsProvider(shell, slotValues) {
+	return createElement(SlotsProvider, {
+		values: slotValues,
+		children: shell
+	});
+}
+//#endregion
+//#region src/server/param-coercion.ts
+/** Global schema codecs, set once at startup from virtual:timber-schema. */
+var _globalCodecs = null;
+/**
+* Run segment param coercion on the matched route's segments.
+*
+* When `globalCodecs` is provided (from app/schema.ts), uses the global
+* codec map keyed by bare param name. Otherwise falls back to loading
+* per-segment params.ts modules.
+*
+* Throws ParamCoercionError if any codec fails (→ 404).
+*
+* This runs BEFORE middleware, so ctx.segmentParams is already typed.
+* See design/07-routing.md §"Where Coercion Runs"
+* See design/41-global-params.md §"Pipeline Integration"
+*/
+async function coerceSegmentParams(match) {
+	const globalCodecs = _globalCodecs;
+	const mergeTarget = Object.create(null);
+	for (const key of Object.keys(match.segmentParams)) if (key !== "__proto__") mergeTarget[key] = match.segmentParams[key];
+	match.segmentParams = mergeTarget;
+	if (globalCodecs) {
+		for (const segment of match.segments) {
+			if (!segment.paramName) continue;
+			const bracketKey = toBracketKey(segment.segmentType, segment.paramName);
+			const codec = globalCodecs[bracketKey];
+			if (!codec) continue;
+			const key = segment.paramName;
+			if (!(key in mergeTarget)) continue;
+			try {
+				mergeTarget[key] = sanitizeParamValue(codec.parse(mergeTarget[key]));
+			} catch (err) {
+				const message = err instanceof Error ? err.message : String(err);
+				if (isDebug()) console.warn(`[timber] Global schema codec rejected value for param "${key}"\n  Error: ${message}\n  Raw value: ${JSON.stringify(mergeTarget[key])}\n  Hint: check the codec in app/schema.ts for key '${bracketKey}'.`);
+				throw new ParamCoercionError(message);
 			}
-			if (outcome.phase === "render") markResponseFlushed();
-			return finalResponse;
-		}
-		case "redirect": {
-			const headers = ctx.responseHeaders ?? new Headers();
-			applyCookieJar(headers);
-			return buildRedirectResponse(outcome.signal, ctx.req, headers);
 		}
-		case "deny": {
-			const headers = ctx.responseHeaders ?? new Headers();
-			applyCookieJar(headers);
-			if (config.renderDenyFallback) try {
-				return cloneWithMutableHeaders(await config.renderDenyFallback(outcome.signal, ctx.req, headers, ctx.match));
-			} catch (denyRenderError) {
-				logRenderError({
-					method: ctx.method,
-					path: ctx.path,
-					error: denyRenderError
-				});
-				await fireOnRequestError(denyRenderError, ctx.req, "render");
-				if (config.onPipelineError && denyRenderError instanceof Error) config.onPipelineError(denyRenderError, "render");
-			}
-			if (isDebug()) console.warn(`[timber] DenySignal(${outcome.signal.status}) from ${outcome.phase} phase — no renderDenyFallback configured, returning bare ${outcome.signal.status} response\n  Request: ${ctx.method} ${ctx.path}\n  Add a not-found.tsx or error.tsx to render a custom deny page.`);
-			return new Response(null, {
-				status: outcome.signal.status,
-				headers
-			});
+		return;
+	}
+	for (const segment of match.segments) {
+		if (!segment.params) continue;
+		let mod;
+		try {
+			mod = await loadModule(segment.params);
+		} catch (err) {
+			const message = `Failed to load params module for segment "${segment.segmentName}": ${err instanceof Error ? err.message : String(err)}`;
+			if (isDebug()) console.warn(`[timber] Param coercion error: ${message}\n  Segment: ${segment.segmentName}\n  Params file: ${segment.params}`);
+			throw new ParamCoercionError(message);
 		}
-		case "error": {
-			const isRsc = (ctx.req.headers.get("Accept") ?? "").includes("text/x-component");
-			if (outcome.phase === "proxy") {
-				logProxyError({ error: outcome.error });
-				await fireOnRequestError(outcome.error, ctx.req, "proxy");
-				if (config.onPipelineError && outcome.error instanceof Error) config.onPipelineError(outcome.error, "proxy");
-				return rscErrorResponse(isRsc, 500);
-			}
-			if (outcome.phase === "middleware") {
-				logMiddlewareError({
-					method: ctx.method,
-					path: ctx.path,
-					error: outcome.error
-				});
-				await fireOnRequestError(outcome.error, ctx.req, "handler");
-				if (config.onPipelineError && outcome.error instanceof Error) config.onPipelineError(outcome.error, "middleware");
-				return rscErrorResponse(isRsc, 500);
-			}
-			const headers = ctx.responseHeaders ?? new Headers();
-			applyCookieJar(headers);
-			logRenderError({
-				method: ctx.method,
-				path: ctx.path,
-				error: outcome.error
-			});
-			await fireOnRequestError(outcome.error, ctx.req, "render");
-			if (config.onPipelineError && outcome.error instanceof Error) config.onPipelineError(outcome.error, "render");
-			if (isRsc) return rscErrorResponse(true, 500, headers);
-			if (config.renderFallbackError) try {
-				return cloneWithMutableHeaders(await config.renderFallbackError(outcome.error, ctx.req, headers));
-			} catch (fallbackRenderError) {
-				logRenderError({
-					method: ctx.method,
-					path: ctx.path,
-					error: fallbackRenderError
-				});
-				await fireOnRequestError(fallbackRenderError, ctx.req, "render");
-				if (config.onPipelineError && fallbackRenderError instanceof Error) config.onPipelineError(fallbackRenderError, "render");
+		const segmentParamsDef = mod.segmentParams;
+		if (!segmentParamsDef || typeof segmentParamsDef.parse !== "function") continue;
+		try {
+			const coerced = segmentParamsDef.parse(match.segmentParams);
+			for (const key of Object.keys(coerced)) if (key !== "__proto__") mergeTarget[key] = sanitizeParamValue(coerced[key]);
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			if (isDebug()) {
+				const rawKeys = Object.keys(match.segmentParams).join(", ");
+				console.warn(`[timber] Param codec rejected values for segment "${segment.segmentName}"\n  Error: ${message}\n  Available raw params: { ${rawKeys} }\n  Params file: ${segment.params}\n  Hint: this usually means a codec threw for the raw URL value.\n  Check that the regex/schema accepts the actual path segment string.`);
 			}
-			return new Response(null, { status: 500 });
+			throw new ParamCoercionError(message);
 		}
 	}
 }
 //#endregion
-//#region src/server/pipeline-phases.ts
+//#region src/client/segment-update-context.ts
 /**
-* Pipeline phase functions — module-level free functions that take their
-* dependencies as explicit parameters. Each phase returns a `PhaseOutcome`
-* (a discriminated union over response / redirect / deny / error) defined
-* in `pipeline-outcome.ts`. The terminal `outcomeToResponse` (also in
-* `pipeline-outcome.ts`) translates outcomes into Responses.
+* SegmentUpdateContext — React context for partial navigation updates.
 *
-* Lifted out of `createPipeline` so each phase can be unit-tested in
-* isolation. The lift is mechanical — these functions used to be closures
-* over `config`; they now take `config` as an explicit parameter.
+* During partial navigation (server skips unchanged sync layouts), the
+* router builds a Map of segment path → ReactNode updates and passes it
+* as the context value. Mounted SegmentOutlet components read from this
+* context to decide whether to render the update or their cached content.
 *
-* See design/07-routing.md §"Request Lifecycle", design/02-rendering-pipeline.md §"Request Flow".
+* SINGLETON GUARANTEE: Uses globalThis + Symbol.for — same pattern as
+* NavigationContext. The RSC client bundler can duplicate this module
+* across chunks (browser-entry graph + client-reference graph). With
+* ESM output, each chunk gets its own module scope — a bare createContext
+* at module level would create separate instances per chunk. globalThis
+* guarantees a single instance regardless of duplication.
+*
+* See design/19-client-navigation.md §"Singleton Guarantee via globalThis"
 */
+var EMPTY_SEGMENT_UPDATES = /* @__PURE__ */ new Map();
+var CTX_KEY = Symbol.for("__timber_segment_update_ctx");
+function getOrCreateContext() {
+	const existing = globalThis[CTX_KEY];
+	if (existing !== void 0) return existing;
+	if (typeof React.createContext === "function") {
+		const ctx = React.createContext(EMPTY_SEGMENT_UPDATES);
+		globalThis[CTX_KEY] = ctx;
+		return ctx;
+	}
+}
+getOrCreateContext();
+//#endregion
+//#region src/client/segment-outlet.tsx
 /**
-* Validate and canonicalize the X-Timber-URL header value.
+* SegmentOutlet — client component boundary at each layout segment.
 *
-* Returns the canonical pathname if valid, or null if rejected:
-* - Must start with '/' (relative pathname, no scheme/authority)
-* - Must not contain control characters
-* - Must pass canonicalization (no encoded separators, null bytes, etc.)
+* Each layout in the segment tree is wrapped with a SegmentOutlet that:
+* 1. Knows its segment path (prop from the server)
+* 2. Reads from SegmentUpdateContext for partial navigation updates
+* 3. Caches its rendered content in a ref across navigations
+*
+* On full navigation: receives new children via props, caches and renders them.
+* On partial navigation (this segment skipped): the context map has no entry
+* for this path, so the outlet returns cached content — preserving layout state.
+* On partial navigation (this segment updated): the context map has content
+* for this path, so the outlet renders the update.
+*
+* Uses React context instead of useSyncExternalStore to stay compatible
+* with concurrent rendering (transitions). All outlets re-render when the
+* context value changes, but each bails out quickly if its segment has
+* no update — same approach as Next.js LayoutRouter.
+*
+* Security: performance optimization only. The server always runs all
+* access.ts files regardless of segment skipping.
+* See design/13-security.md §"State tree manipulation".
 */
-function validateInterceptionHeader(raw, stripTrailingSlash) {
-	if (!raw.startsWith("/")) return null;
-	if (raw.startsWith("//")) return null;
-	for (let i = 0; i < raw.length; i++) {
-		const code = raw.charCodeAt(i);
-		if (code <= 31 || code === 127) return null;
+//#endregion
+//#region src/server/route-element-builder.ts
+/**
+* Thrown when a defineSegmentParams codec's parse() fails.
+* The pipeline catches this and responds with 404.
+*/
+var ParamCoercionError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ParamCoercionError";
 	}
-	const result = canonicalize(raw, stripTrailingSlash);
-	if (!result.ok) return null;
-	return result.pathname;
-}
+};
+//#endregion
+//#region src/server/pipeline-metadata.ts
 /**
-* Run the proxy.ts phase. Calls user proxy code with a `next()` continuation.
+* Metadata route helpers for the request pipeline.
 *
-* When `next` is provided, it replaces the default `handleRequest` as the
-* continuation — this lets the pipeline inject action dispatch between proxy
-* and route matching (TIM-1213). The proxy resolver was picked at pipeline
-* construction time so the hot path sees no per-request branching on the
-* `ProxyConfig` discriminant.
+* Handles serving static metadata files and serializing sitemap responses.
+* Extracted from pipeline.ts to keep files under 500 lines.
+*
+* See design/16-metadata.md §"Metadata Routes"
 */
-async function runProxyPhase(config, getProxy, req, method, path, next) {
-	const detailed = config.serverTiming === "detailed";
-	try {
-		const proxyExport = await getProxy();
-		const continuation = next ?? (() => handleRequest(config, req, method, path, true));
-		const proxyFn = () => runProxy(proxyExport, req, continuation);
-		return {
-			kind: "response",
-			phase: "proxy",
-			response: await withSpan("timber.proxy", {}, () => detailed ? withTiming("proxy", "proxy.ts", proxyFn) : proxyFn())
-		};
-	} catch (error) {
-		if (error instanceof RedirectSignal) return {
-			kind: "redirect",
-			phase: "proxy",
-			signal: error
-		};
-		if (error instanceof DenySignal) return {
-			kind: "deny",
-			phase: "proxy",
-			signal: error
-		};
-		return {
-			kind: "error",
-			phase: "proxy",
-			error
-		};
-	}
-}
 /**
-* Run the middleware chain phase. If the chain short-circuits with a Response,
-* returns it as a 'response' outcome. Otherwise applies the request header
-* overlay and falls through to the render phase.
+* Content types that are text-based and should include charset=utf-8.
+* Binary formats (images) should not include charset.
 */
-async function runMiddlewarePhase(config, req, match, responseHeaders, requestHeaderOverlay, renderContext) {
-	const detailed = config.serverTiming === "detailed";
-	const ctx = {
-		req,
-		requestHeaders: requestHeaderOverlay,
-		headers: responseHeaders,
-		segmentParams: match.segmentParams,
-		earlyHints: (hints) => {
-			for (const hint of hints) {
-				let value;
-				if (hint.as !== void 0) value = `<${hint.href}>; as=${hint.as}; rel=${hint.rel}`;
-				else value = `<${hint.href}>; rel=${hint.rel}`;
-				if (hint.crossOrigin !== void 0) value += `; crossorigin=${hint.crossOrigin}`;
-				if (hint.fetchPriority !== void 0) value += `; fetchpriority=${hint.fetchPriority}`;
-				responseHeaders.append("Link", value);
-			}
-		}
+var TEXT_CONTENT_TYPES = /* @__PURE__ */ new Set([
+	"application/xml",
+	"text/plain",
+	"application/json",
+	"application/manifest+json",
+	"image/svg+xml"
+]);
+/**
+* Serve a static metadata file by reading it from disk.
+*
+* Static metadata route files (.xml, .txt, .json, .png, .ico, .svg, etc.)
+* are served as-is with the appropriate Content-Type header.
+* Text files include charset=utf-8; binary files do not.
+*
+* See design/16-metadata.md §"Metadata Routes"
+*/
+async function serveStaticMetadataFile(metaMatch) {
+	const { contentType, file } = metaMatch;
+	const isText = TEXT_CONTENT_TYPES.has(contentType);
+	const body = await readFile(file.filePath);
+	const headers = {
+		"Content-Type": isText ? `${contentType}; charset=utf-8` : contentType,
+		"Content-Length": String(body.byteLength),
+		"Cache-Control": "public, max-age=14400, must-revalidate"
 	};
-	try {
-		const chainFn = () => runMiddlewareChain(match.middlewareChain, ctx);
-		const middlewareResponse = await (async () => {
-			setMutableCookieContext(true);
-			try {
-				return await withSpan("timber.middleware", {}, () => detailed ? withTiming("mw", "middleware.ts", chainFn) : chainFn());
-			} finally {
-				setMutableCookieContext(false);
-			}
-		})();
-		if (middlewareResponse) return {
-			kind: "response",
-			phase: "middleware",
-			response: middlewareResponse
-		};
-		applyRequestHeaderOverlay(requestHeaderOverlay);
-		applyCookieJar(responseHeaders);
-		return runRenderPhase(config, req, match, responseHeaders, requestHeaderOverlay, renderContext);
-	} catch (error) {
-		if (error instanceof RedirectSignal) return {
-			kind: "redirect",
-			phase: "middleware",
-			signal: error
-		};
-		if (error instanceof DenySignal) return {
-			kind: "deny",
-			phase: "middleware",
-			signal: error
-		};
-		return {
-			kind: "error",
-			phase: "middleware",
-			error
-		};
-	}
+	return new Response(body, {
+		status: 200,
+		headers
+	});
 }
 /**
-* Run the render phase. Wraps the configured renderer in a span and a
-* timing scope, and translates thrown signals into outcome variants.
+* Serialize a sitemap array to XML.
+* Follows the sitemap.org protocol: https://www.sitemaps.org/protocol.html
 */
-async function runRenderPhase(config, req, match, responseHeaders, requestHeaderOverlay, { canonicalPathname, interception }) {
-	const detailed = config.serverTiming === "detailed";
-	try {
-		const renderFn = () => config.render(req, match, responseHeaders, requestHeaderOverlay, interception);
-		return {
-			kind: "response",
-			phase: "render",
-			response: await withSpan("timber.render", { "http.route": canonicalPathname }, () => detailed ? withTiming("render", "RSC + SSR render", renderFn) : renderFn())
-		};
-	} catch (error) {
-		if (error instanceof DenySignal) return {
-			kind: "deny",
-			phase: "render",
-			signal: error
-		};
-		if (error instanceof RedirectSignal) return {
-			kind: "redirect",
-			phase: "render",
-			signal: error
-		};
-		return {
-			kind: "error",
-			phase: "render",
-			error
-		};
-	}
+function serializeSitemap(entries) {
+	return `<?xml version="1.0" encoding="UTF-8"?>\n<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">\n${entries.map((e) => {
+		let xml = `  <url>\n    <loc>${escapeXml(e.url)}</loc>`;
+		if (e.lastModified) {
+			const date = e.lastModified instanceof Date ? e.lastModified.toISOString() : e.lastModified;
+			xml += `\n    <lastmod>${escapeXml(date)}</lastmod>`;
+		}
+		if (e.changeFrequency) xml += `\n    <changefreq>${escapeXml(e.changeFrequency)}</changefreq>`;
+		if (e.priority !== void 0) xml += `\n    <priority>${e.priority}</priority>`;
+		xml += "\n  </url>";
+		return xml;
+	}).join("\n")}\n</urlset>`;
+}
+/** Escape special XML characters. */
+function escapeXml(str) {
+	return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
 }
+//#endregion
+//#region src/server/pipeline-interception.ts
 /**
-* Process a single request from canonicalization through phase dispatch.
+* Interception route matching for the request pipeline.
 *
-* Stages: canonicalize → metadata routes → auto-sitemap → version skew →
-* route match → interception → early hints → param coercion → middleware →
-* render → outcome translation. Pre-routing short-circuits return Responses
-* directly; post-match dispatch goes through `outcomeToResponse`.
+* Matches target URLs against interception rewrites to support the
+* modal route pattern (soft navigation intercepts).
 *
-* Used both as the top-level entry (when no proxy.ts is configured) and as
-* the `next()` continuation passed to `runProxy()`.
+* Extracted from pipeline.ts to keep files under 500 lines.
 *
-* @param pathIsCanonical When true, `path` has already been canonicalized by
-*   `createPipeline` — skip re-canonicalization to prevent double-decode.
-*   When false (default), runs canonicalize as a safety net for direct callers.
+* See design/07-routing.md §"Intercepting Routes"
 */
-async function handleRequest(config, req, method, path, pathIsCanonical) {
-	const stripTrailingSlash = config.stripTrailingSlash ?? true;
-	let canonicalPathname;
-	if (pathIsCanonical) canonicalPathname = path;
-	else {
-		const result = canonicalize(path, stripTrailingSlash);
-		if (!result.ok) {
-			if (isDebug()) console.warn(`[timber] URL canonicalization rejected ${method} ${path} — responding with ${result.status}\n  This usually means the URL contains encoded separators (%2f, %5c),\n  null bytes (%00), path traversal (..), or malformed percent-encoding.`);
-			return new Response(null, { status: result.status });
-		}
-		canonicalPathname = result.pathname;
+/**
+* Check if a pathname starts with a prefix on a segment boundary.
+*
+* Prevents /feed from matching /feed-private — the prefix must be
+* followed by '/' or be an exact match.
+*/
+function hasSegmentPrefix(pathname, prefix) {
+	if (prefix === "/") return true;
+	if (!pathname.startsWith(prefix)) return false;
+	return pathname.length === prefix.length || pathname[prefix.length] === "/";
+}
+/**
+* Check if an intercepting route applies for this soft navigation.
+*
+* Matches the target pathname against interception rewrites, constrained
+* by the source URL (X-Timber-URL header — where the user navigates FROM).
+*
+* Returns the source pathname to re-match if interception applies, or null.
+*/
+function findInterceptionMatch(targetPathname, sourceUrl, rewrites) {
+	for (const rewrite of rewrites) {
+		if (!hasSegmentPrefix(sourceUrl, rewrite.interceptingPrefix)) continue;
+		if (pathnameMatchesPattern(targetPathname, rewrite.interceptedPattern)) return { sourcePathname: rewrite.interceptingPrefix };
 	}
-	if (config.matchMetadataRoute) {
-		const metaMatch = config.matchMetadataRoute(canonicalPathname);
-		if (metaMatch) try {
-			if (metaMatch.isStatic) return await serveStaticMetadataFile(metaMatch);
-			setSegmentParams(metaMatch.segmentParams);
-			const mod = await loadModule(metaMatch.file);
-			if (typeof mod.default !== "function") {
-				if (isDebug()) console.warn(`[timber] Metadata route ${metaMatch.file} does not export a default function — responding with 500\n  Metadata routes must export a default function that returns the metadata content.`);
-				return new Response("Metadata route must export a default function", { status: 500 });
-			}
-			const handlerResult = await mod.default();
-			if (handlerResult instanceof Response) {
-				if (method === "HEAD") {
-					const headHeaders = new Headers(handlerResult.headers);
-					if (handlerResult.ok && !headHeaders.has("Cache-Control")) headHeaders.set("Cache-Control", "public, max-age=14400, must-revalidate");
-					return new Response(null, {
-						status: handlerResult.status,
-						statusText: handlerResult.statusText,
-						headers: headHeaders
-					});
+	return null;
+}
+/**
+* Check if a pathname matches a URL pattern with dynamic segments.
+*
+* Supports [param] (single segment) and [...param] (one or more segments).
+* Static segments must match exactly.
+*/
+function pathnameMatchesPattern(pathname, pattern) {
+	const pathParts = pathname === "/" ? [] : pathname.slice(1).split("/");
+	const patternParts = pattern === "/" ? [] : pattern.slice(1).split("/");
+	let pi = 0;
+	for (let i = 0; i < patternParts.length; i++) {
+		const seg = classifyUrlSegment(patternParts[i]);
+		switch (seg.kind) {
+			case "catch-all": return pi < pathParts.length;
+			case "optional-catch-all": return true;
+			case "dynamic": {
+				if (pi >= pathParts.length) return false;
+				const prefix = seg.prefix ?? "";
+				const suffix = seg.suffix ?? "";
+				const pathPart = pathParts[pi];
+				if (prefix || suffix) {
+					if (pathPart.length <= prefix.length + suffix.length || prefix && !pathPart.startsWith(prefix) || suffix && !pathPart.endsWith(suffix)) return false;
 				}
-				const res = cloneWithMutableHeaders(handlerResult);
-				if (res.ok && !res.headers.has("Cache-Control")) res.headers.set("Cache-Control", "public, max-age=14400, must-revalidate");
-				return res;
+				pi++;
+				continue;
 			}
-			const contentType = metaMatch.contentType;
-			let body;
-			if (typeof handlerResult === "string") body = handlerResult;
-			else if (contentType === "application/xml") body = serializeSitemap(handlerResult);
-			else if (contentType === "application/manifest+json") body = JSON.stringify(handlerResult, null, 2);
-			else body = String(handlerResult);
-			return new Response(body, {
-				status: 200,
-				headers: {
-					"Content-Type": `${contentType}; charset=utf-8`,
-					"Cache-Control": "public, max-age=14400, must-revalidate"
-				}
-			});
-		} catch (error) {
-			if (error instanceof RedirectSignal) return new Response(null, {
-				status: error.status,
-				headers: { Location: error.location }
-			});
-			if (error instanceof DenySignal) return new Response(null, { status: error.status });
-			logRenderError({
-				method,
-				path,
-				error
-			});
-			if (config.onPipelineError && error instanceof Error) config.onPipelineError(error, "metadata-route");
-			return new Response(null, { status: 500 });
-		}
-	}
-	if (config.autoSitemapHandler) try {
-		const sitemapResponse = await config.autoSitemapHandler(canonicalPathname);
-		if (sitemapResponse) return cloneWithMutableHeaders(sitemapResponse);
-	} catch (error) {
-		logRenderError({
-			method,
-			path,
-			error
-		});
-		if (config.onPipelineError && error instanceof Error) config.onPipelineError(error, "auto-sitemap");
-		return new Response(null, { status: 500 });
-	}
-	const isRscRequest = (req.headers.get("Accept") ?? "").includes("text/x-component");
-	if (isRscRequest) {
-		if (!checkVersionSkew(req).ok) {
-			const reloadHeaders = new Headers();
-			applyReloadHeaders(reloadHeaders);
-			return new Response(null, {
-				status: 204,
-				headers: reloadHeaders
-			});
-		}
-	}
-	let match = config.matchRoute(canonicalPathname);
-	let interception;
-	if (isRscRequest && config.interceptionRewrites?.length) {
-		const rawSourceUrl = req.headers.get("X-Timber-URL");
-		const validatedSourceUrl = rawSourceUrl ? validateInterceptionHeader(rawSourceUrl, stripTrailingSlash) : null;
-		if (validatedSourceUrl) {
-			const intercepted = findInterceptionMatch(canonicalPathname, validatedSourceUrl, config.interceptionRewrites);
-			if (intercepted) {
-				const sourceMatch = config.matchRoute(intercepted.sourcePathname);
-				if (sourceMatch) {
-					match = sourceMatch;
-					interception = { targetPathname: canonicalPathname };
-				}
-			}
-		}
-	}
-	if (!match) {
-		if (isDebug()) console.warn(`[timber] No route matched for pathname: ${canonicalPathname}\n  Input path: ${path}\n  Method: ${method}`);
-		if (config.renderNoMatch) {
-			const responseHeaders = new Headers();
-			return cloneWithMutableHeaders(await config.renderNoMatch(req, responseHeaders));
-		}
-		return new Response(null, { status: 404 });
-	}
-	const responseHeaders = new Headers();
-	const requestHeaderOverlay = new Headers();
-	responseHeaders.set("Cache-Control", "private, no-cache, no-store, max-age=0, must-revalidate");
-	const leafSegment = match.segments[match.segments.length - 1];
-	const isApiRoute = leafSegment?.route && !leafSegment?.page;
-	if (config.earlyHints && !isRscRequest && !isApiRoute) try {
-		await config.earlyHints(match, req, responseHeaders);
-	} catch (err) {
-		swallow(err, "early hints hook threw");
-	}
-	match.rawSegmentParams = { ...match.segmentParams };
-	try {
-		await coerceSegmentParams(match);
-	} catch (error) {
-		if (error instanceof ParamCoercionError) {
-			if (isDebug()) {
-				const segmentChain = match.segments.map((s) => s.segmentName || "/").join(" → ");
-				console.warn(`[timber] Param coercion failed for ${method} ${canonicalPathname} — responding with 404\n  Matched segments: ${segmentChain}\n  Error: ${error.message}\n  This usually means a params.ts codec rejected the URL params.\n  Check that all fields in defineSegmentParams() are optional for params\n  that don't appear at every route depth (e.g. year, month, day).`);
-			}
-			const leafSegment = match.segments[match.segments.length - 1];
-			if (leafSegment.route && !leafSegment.page) return new Response(null, { status: 404 });
-			if (config.renderNoMatch) return cloneWithMutableHeaders(await config.renderNoMatch(req, responseHeaders));
-			return new Response(null, { status: 404 });
+			case "static":
+				if (pi >= pathParts.length || pathParts[pi] !== seg.value) return false;
+				pi++;
+				continue;
 		}
-		throw error;
 	}
-	setSegmentParams(match.segmentParams);
-	const segmentPath = match.segments.map((s) => s.segmentName).filter(Boolean).join("/") || "/";
-	setMatchedSegmentPath(segmentPath.startsWith("/") ? segmentPath : `/${segmentPath}`);
-	return outcomeToResponse(config, match.middlewareChain.length > 0 ? await runMiddlewarePhase(config, req, match, responseHeaders, requestHeaderOverlay, {
-		canonicalPathname,
-		interception
-	}) : await runRenderPhase(config, req, match, responseHeaders, requestHeaderOverlay, {
-		canonicalPathname,
-		interception
-	}), {
-		req,
-		method,
-		path,
-		responseHeaders,
-		match
-	});
+	return pi === pathParts.length;
 }
 //#endregion
-//#region src/server/pipeline.ts
+//#region src/server/pipeline-outcome.ts
 /**
-* Create the request handler from a pipeline configuration.
+* Pipeline outcome translator — converts a `PhaseOutcome` (the value
+* each phase function returns) into a final `Response`.
 *
-* Returns a function that processes an incoming Request through all pipeline
-* stages and produces a Response. This is the top-level entry point for the
-* server. The body is intentionally small — phase logic lives in
-* `pipeline-phases.ts`. This function only owns the per-request setup that
-* has to wrap the entire dispatch: trace ID, request context ALS, span
-* scope, Server-Timing header emission, and the active-request counter.
+* Lifted out of `pipeline-phases.ts` (TIM-853) so the per-phase try /
+* catch logic and the terminal Response-building logic each live in
+* their own file. The phases produce values; this module is the single
+* source of truth for how those values become wire responses.
+*
+* See design/07-routing.md §"Request Lifecycle".
 */
-function createPipeline(config) {
-	const proxyResolver = makeProxyResolver(config.proxy);
-	const slowRequestMs = config.slowRequestMs ?? 3e3;
-	const serverTiming = config.serverTiming ?? "total";
-	let activeRequests = 0;
-	const pipelineFn = async (req) => {
-		const url = new URL(req.url);
-		const method = req.method;
-		const path = url.pathname;
-		const startTime = performance.now();
-		activeRequests++;
-		return runWithTraceId(generateTraceId(), async () => {
-			return runWithRequestContext(req, async () => {
-				const runRequest = async () => {
-					logRequestReceived({
-						method,
-						path
-					});
-					const response = await withSpan("http.server.request", {
-						"http.request.method": method,
-						"url.path": path
-					}, async () => {
-						const otelIds = await getOtelTraceId();
-						if (otelIds) replaceTraceId(otelIds.traceId, otelIds.spanId);
-						const stripTrailingSlash = config.stripTrailingSlash ?? true;
-						const canonResult = canonicalize(url.pathname, stripTrailingSlash);
-						if (!canonResult.ok) {
-							if (isDebug()) console.warn(`[timber] URL canonicalization rejected ${method} ${url.pathname} — responding with ${canonResult.status}\n  This usually means the URL contains encoded separators (%2f, %5c),\n  null bytes (%00), path traversal (..), or malformed percent-encoding.`);
-							return new Response(null, { status: canonResult.status });
-						}
-						const canonicalPath = canonResult.pathname;
-						let canonicalReq = req;
-						if (url.pathname !== canonicalPath) {
-							const canonicalUrl = new URL(req.url);
-							canonicalUrl.pathname = canonicalPath;
-							canonicalReq = new Request(canonicalUrl.toString(), req);
-						}
-						const innerHandler = async () => {
-							if (config.dispatchAction) {
-								const actionResult = await config.dispatchAction(canonicalReq, canonicalPath, pipelineFn);
-								if (actionResult) return actionResult;
-							}
-							return handleRequest(config, canonicalReq, method, canonicalPath, true);
-						};
-						let result;
-						if (proxyResolver) result = await outcomeToResponse(config, await runProxyPhase(config, proxyResolver, canonicalReq, method, canonicalPath, innerHandler), {
-							req: canonicalReq,
-							method,
-							path: canonicalPath
-						});
-						else result = await innerHandler();
-						await setSpanAttribute("http.response.status_code", result.status);
-						const varyTokens = ["Accept"];
-						if (config.interceptionRewrites?.length) varyTokens.push("X-Timber-URL");
-						const existingVary = result.headers.get("Vary");
-						const existingTokens = existingVary ? existingVary.toLowerCase().split(",").map((t) => t.trim()) : [];
-						const newTokens = varyTokens.filter((t) => !existingTokens.includes(t.toLowerCase()));
-						if (newTokens.length > 0) result.headers.set("Vary", existingVary ? `${existingVary}, ${newTokens.join(", ")}` : newTokens.join(", "));
-						if (serverTiming === "detailed") {
-							const timingHeader = getServerTimingHeader();
-							if (timingHeader) result.headers.set("Server-Timing", timingHeader);
-						} else if (serverTiming === "total") {
-							const totalMs = Math.round(performance.now() - startTime);
-							result.headers.set("Server-Timing", `total;dur=${totalMs}`);
-						}
-						if (serverTiming === "detailed" && result.body) result = new Response(wrapResponseWithStreamTiming(result.body, startTime), {
-							status: result.status,
-							statusText: result.statusText,
-							headers: result.headers
-						});
-						return result;
-					});
-					const durationMs = Math.round(performance.now() - startTime);
-					const status = response.status;
-					const concurrency = activeRequests;
-					activeRequests--;
-					logRequestCompleted({
-						method,
-						path,
-						status,
-						durationMs,
-						concurrency
-					});
-					if (slowRequestMs > 0 && durationMs > slowRequestMs) logSlowRequest({
-						method,
-						path,
-						durationMs,
-						threshold: slowRequestMs,
-						concurrency
-					});
-					return response;
-				};
-				return serverTiming === "detailed" ? runWithTimingCollector(runRequest) : runRequest();
-			});
-		});
-	};
-	return pipelineFn;
+function rscErrorResponse(isRsc, status, headers) {
+	if (!isRsc) return new Response(null, { status });
+	const h = headers ?? new Headers();
+	h.set("X-Timber-Error", "1");
+	h.set("content-type", "application/json; charset=utf-8");
+	return new Response(JSON.stringify({
+		error: true,
+		status
+	}), {
+		status,
+		headers: h
+	});
 }
-//#endregion
-//#region src/server/build-manifest.ts
 /**
-* Collect all CSS files needed for a matched route's segment chain.
+* Terminal outcome handler — converts a `PhaseOutcome` into a final
+* `Response`, applying cookies, building redirects, rendering deny pages
+* and fallback error pages, and firing instrumentation hooks.
 *
-* Walks segments root → leaf, collecting CSS for each layout and page.
-* Deduplicates while preserving order (root layout CSS first).
+* This is the single source of truth for how phase outputs become wire
+* responses; the per-phase try/catch blocks now produce values, not
+* Responses, so the conversion logic lives in exactly one place.
 */
-function collectRouteCss(segments, manifest) {
-	const seen = /* @__PURE__ */ new Set();
-	const result = [];
-	for (const segment of segments) for (const file of [segment.layout, segment.page]) {
-		if (!file) continue;
-		const cssFiles = manifest.css[file.filePath];
-		if (!cssFiles) continue;
-		for (const url of cssFiles) if (!seen.has(url)) {
-			seen.add(url);
-			result.push(url);
+async function outcomeToResponse(config, outcome, ctx) {
+	switch (outcome.kind) {
+		case "response": {
+			const finalResponse = cloneWithMutableHeaders(outcome.response);
+			if (outcome.phase === "proxy") return finalResponse;
+			if (outcome.phase === "middleware" && ctx.responseHeaders) {
+				applyCookieJar(finalResponse.headers);
+				mergeMissingHeaders(finalResponse.headers, ctx.responseHeaders);
+				logMiddlewareShortCircuit({
+					method: ctx.method,
+					path: ctx.path,
+					status: finalResponse.status
+				});
+			}
+			if (outcome.phase === "render") markResponseFlushed();
+			return finalResponse;
+		}
+		case "redirect": {
+			const headers = ctx.responseHeaders ?? new Headers();
+			applyCookieJar(headers);
+			return buildRedirectResponse(outcome.signal, ctx.req, headers);
+		}
+		case "deny": {
+			const headers = ctx.responseHeaders ?? new Headers();
+			applyCookieJar(headers);
+			if (config.renderDenyFallback) try {
+				return cloneWithMutableHeaders(await config.renderDenyFallback(outcome.signal, ctx.req, headers, ctx.match));
+			} catch (denyRenderError) {
+				logRenderError({
+					method: ctx.method,
+					path: ctx.path,
+					error: denyRenderError
+				});
+				await fireOnRequestError(denyRenderError, ctx.req, "render");
+				if (config.onPipelineError && denyRenderError instanceof Error) config.onPipelineError(denyRenderError, "render");
+			}
+			if (isDebug()) console.warn(`[timber] DenySignal(${outcome.signal.status}) from ${outcome.phase} phase — no renderDenyFallback configured, returning bare ${outcome.signal.status} response\n  Request: ${ctx.method} ${ctx.path}\n  Add a not-found.tsx or error.tsx to render a custom deny page.`);
+			return new Response(null, {
+				status: outcome.signal.status,
+				headers
+			});
+		}
+		case "error": {
+			const isRsc = (ctx.req.headers.get("Accept") ?? "").includes("text/x-component");
+			if (outcome.phase === "proxy") {
+				logProxyError({ error: outcome.error });
+				await fireOnRequestError(outcome.error, ctx.req, "proxy");
+				if (config.onPipelineError && outcome.error instanceof Error) config.onPipelineError(outcome.error, "proxy");
+				return rscErrorResponse(isRsc, 500);
+			}
+			if (outcome.phase === "middleware") {
+				logMiddlewareError({
+					method: ctx.method,
+					path: ctx.path,
+					error: outcome.error
+				});
+				await fireOnRequestError(outcome.error, ctx.req, "handler");
+				if (config.onPipelineError && outcome.error instanceof Error) config.onPipelineError(outcome.error, "middleware");
+				return rscErrorResponse(isRsc, 500);
+			}
+			const headers = ctx.responseHeaders ?? new Headers();
+			applyCookieJar(headers);
+			logRenderError({
+				method: ctx.method,
+				path: ctx.path,
+				error: outcome.error
+			});
+			await fireOnRequestError(outcome.error, ctx.req, "render");
+			if (config.onPipelineError && outcome.error instanceof Error) config.onPipelineError(outcome.error, "render");
+			if (isRsc) return rscErrorResponse(true, 500, headers);
+			if (config.renderFallbackError) try {
+				return cloneWithMutableHeaders(await config.renderFallbackError(outcome.error, ctx.req, headers));
+			} catch (fallbackRenderError) {
+				logRenderError({
+					method: ctx.method,
+					path: ctx.path,
+					error: fallbackRenderError
+				});
+				await fireOnRequestError(fallbackRenderError, ctx.req, "render");
+				if (config.onPipelineError && fallbackRenderError instanceof Error) config.onPipelineError(fallbackRenderError, "render");
+			}
+			return new Response(null, { status: 500 });
 		}
 	}
-	return result;
 }
+//#endregion
+//#region src/server/pipeline-phases.ts
 /**
-* Collect all font entries needed for a matched route's segment chain.
+* Pipeline phase functions — module-level free functions that take their
+* dependencies as explicit parameters. Each phase returns a `PhaseOutcome`
+* (a discriminated union over response / redirect / deny / error) defined
+* in `pipeline-outcome.ts`. The terminal `outcomeToResponse` (also in
+* `pipeline-outcome.ts`) translates outcomes into Responses.
 *
-* Walks segments root → leaf, collecting fonts for each layout and page.
-* Deduplicates by href while preserving order.
+* Lifted out of `createPipeline` so each phase can be unit-tested in
+* isolation. The lift is mechanical — these functions used to be closures
+* over `config`; they now take `config` as an explicit parameter.
+*
+* See design/07-routing.md §"Request Lifecycle", design/02-rendering-pipeline.md §"Request Flow".
 */
-function collectRouteFonts(segments, manifest) {
-	const seen = /* @__PURE__ */ new Set();
-	const result = [];
-	for (const segment of segments) for (const file of [segment.layout, segment.page]) {
-		if (!file) continue;
-		const fonts = manifest.fonts[file.filePath];
-		if (!fonts) continue;
-		for (const entry of fonts) if (!seen.has(entry.href)) {
-			seen.add(entry.href);
-			result.push(entry);
-		}
-	}
-	return result;
-}
 /**
-* Collect modulepreload URLs for a matched route's segment chain.
+* Validate and canonicalize the X-Timber-URL header value.
 *
-* Walks segments root → leaf, collecting transitive JS dependencies
-* for each layout and page. Deduplicates across segments.
+* Returns the canonical pathname if valid, or null if rejected:
+* - Must start with '/' (relative pathname, no scheme/authority)
+* - Must not contain control characters
+* - Must pass canonicalization (no encoded separators, null bytes, etc.)
 */
-function collectRouteModulepreloads(segments, manifest) {
-	const seen = /* @__PURE__ */ new Set();
-	const result = [];
-	for (const segment of segments) for (const file of [segment.layout, segment.page]) {
-		if (!file) continue;
-		const preloads = manifest.modulepreload[file.filePath];
-		if (!preloads) continue;
-		for (const url of preloads) if (!seen.has(url)) {
-			seen.add(url);
-			result.push(url);
-		}
+function validateInterceptionHeader(raw, stripTrailingSlash) {
+	if (!raw.startsWith("/")) return null;
+	if (raw.startsWith("//")) return null;
+	for (let i = 0; i < raw.length; i++) {
+		const code = raw.charCodeAt(i);
+		if (code <= 31 || code === 127) return null;
 	}
-	return result;
+	const result = canonicalize(raw, stripTrailingSlash);
+	if (!result.ok) return null;
+	return result.pathname;
 }
-//#endregion
-//#region src/server/early-hints.ts
-/**
-* 103 Early Hints utilities.
-*
-* Early Hints are sent before the final response to let the browser
-* start fetching critical resources (CSS, fonts, JS) while the server
-* is still rendering.
-*
-* The framework collects hints from two sources:
-* 1. Build manifest — CSS, fonts, and JS chunks known at route-match time
-* 2. ctx.earlyHints() — explicit hints added by middleware or route handlers
-*
-* Both are emitted as Link headers. Cloudflare CDN automatically converts
-* Link headers into 103 Early Hints responses.
-*
-* Design docs: 02-rendering-pipeline.md §"Early Hints (103)"
-*/
 /**
-* Format a single EarlyHint as a Link header value.
-*
-* Attribute order: `as` before `rel` to match Cloudflare CDN's cached
-* Early Hints format. Cloudflare caches Link headers from 200 responses
-* and re-emits them as 103 Early Hints on subsequent requests. If our
-* attribute order differs from Cloudflare's cached copy, the browser
-* sees two preload headers for the same URL (different attribute order)
-* and warns "Preload was ignored." Matching the order ensures the
-* browser deduplicates them correctly.
+* Run the proxy.ts phase. Calls user proxy code with a `next()` continuation.
 *
-* Examples:
-*   `</styles/root.css>; as=style; rel=preload`
-*   `</fonts/inter.woff2>; as=font; rel=preload; crossorigin=anonymous`
-*   `</_timber/client.js>; rel=modulepreload`
-*   `<https://fonts.googleapis.com>; rel=preconnect`
+* When `next` is provided, it replaces the default `handleRequest` as the
+* continuation — this lets the pipeline inject action dispatch between proxy
+* and route matching (TIM-1213). The proxy resolver was picked at pipeline
+* construction time so the hot path sees no per-request branching on the
+* `ProxyConfig` discriminant.
 */
-function formatLinkHeader(hint) {
-	if (hint.as !== void 0) {
-		let value = `<${hint.href}>; as=${hint.as}; rel=${hint.rel}`;
-		if (hint.crossOrigin !== void 0) value += `; crossorigin=${hint.crossOrigin}`;
-		if (hint.fetchPriority !== void 0) value += `; fetchpriority=${hint.fetchPriority}`;
-		return value;
+async function runProxyPhase(config, getProxy, req, method, path, next) {
+	const detailed = config.serverTiming === "detailed";
+	try {
+		const proxyExport = await getProxy();
+		const continuation = next ?? (() => handleRequest(config, req, method, path, true));
+		const proxyFn = () => runProxy(proxyExport, req, continuation);
+		return {
+			kind: "response",
+			phase: "proxy",
+			response: await withSpan("timber.proxy", {}, () => detailed ? withTiming("proxy", "proxy.ts", proxyFn) : proxyFn())
+		};
+	} catch (error) {
+		if (error instanceof RedirectSignal) return {
+			kind: "redirect",
+			phase: "proxy",
+			signal: error
+		};
+		if (error instanceof DenySignal) return {
+			kind: "deny",
+			phase: "proxy",
+			signal: error
+		};
+		return {
+			kind: "error",
+			phase: "proxy",
+			error
+		};
 	}
-	let value = `<${hint.href}>; rel=${hint.rel}`;
-	if (hint.crossOrigin !== void 0) value += `; crossorigin=${hint.crossOrigin}`;
-	if (hint.fetchPriority !== void 0) value += `; fetchpriority=${hint.fetchPriority}`;
-	return value;
 }
 /**
-* Collect all Link header strings for a matched route's segment chain.
-*
-* Walks the build manifest to emit hints for:
-* - CSS stylesheets (as=style; rel=preload)
-* - Font assets (as=font; rel=preload; crossorigin)
-* - JS modulepreload hints (rel=modulepreload) — unless skipJs is set
-*
-* Returns formatted Link header strings, deduplicated by URL, root → leaf order.
-* Returns an empty array in dev mode (manifest is empty).
+* Run the middleware chain phase. If the chain short-circuits with a Response,
+* returns it as a 'response' outcome. Otherwise applies the request header
+* overlay and falls through to the render phase.
 */
-function collectEarlyHintHeaders(segments, manifest, options) {
-	const result = [];
-	const seenUrls = /* @__PURE__ */ new Set();
-	const add = (url, header) => {
-		if (!seenUrls.has(url)) {
-			seenUrls.add(url);
-			result.push(header);
+async function runMiddlewarePhase(config, req, match, responseHeaders, requestHeaderOverlay, renderContext) {
+	const detailed = config.serverTiming === "detailed";
+	const ctx = {
+		req,
+		requestHeaders: requestHeaderOverlay,
+		headers: responseHeaders,
+		segmentParams: match.segmentParams,
+		earlyHints: (hints) => {
+			for (const hint of hints) {
+				let value;
+				if (hint.as !== void 0) value = `<${hint.href}>; as=${hint.as}; rel=${hint.rel}`;
+				else value = `<${hint.href}>; rel=${hint.rel}`;
+				if (hint.crossOrigin !== void 0) value += `; crossorigin=${hint.crossOrigin}`;
+				if (hint.fetchPriority !== void 0) value += `; fetchpriority=${hint.fetchPriority}`;
+				responseHeaders.append("Link", value);
+			}
 		}
 	};
-	for (const url of collectRouteCss(segments, manifest)) add(url, formatLinkHeader({
-		href: url,
-		rel: "preload",
-		as: "style"
-	}));
-	for (const font of collectRouteFonts(segments, manifest)) add(font.href, formatLinkHeader({
-		href: font.href,
-		rel: "preload",
-		as: "font",
-		crossOrigin: "anonymous"
-	}));
-	if (!options?.skipJs) for (const url of collectRouteModulepreloads(segments, manifest)) add(url, formatLinkHeader({
-		href: url,
-		rel: "modulepreload"
-	}));
-	return result;
-}
-//#endregion
-//#region src/server/early-hints-sender.ts
-/**
-* Per-request 103 Early Hints sender — ALS bridge for platform adapters.
-*
-* The pipeline collects Link headers for CSS, fonts, and JS chunks at
-* route-match time. On platforms that support it (Node.js v18.11+, Bun),
-* the adapter can send these as a 103 Early Hints interim response before
-* the final response is ready.
-*
-* This module provides an ALS-based bridge: the generated entry point
-* (e.g., the Nitro entry) wraps the handler with `runWithEarlyHintsSender`,
-* binding a per-request sender function. The pipeline calls
-* `sendEarlyHints103()` to fire the 103 if a sender is available.
-*
-* On platforms where 103 is handled at the CDN level (e.g., Cloudflare
-* converts Link headers into 103 automatically), no sender is installed
-* and `sendEarlyHints103()` is a no-op.
-*
-* Design doc: 02-rendering-pipeline.md §"Early Hints (103)"
-*/
-/**
-* Run a function with a per-request early hints sender installed.
-*
-* Called by generated entry points (e.g., Nitro node-server/bun) to
-* bind the platform's writeEarlyHints capability for the request duration.
-*/
-function runWithEarlyHintsSender(sender, fn) {
-	return earlyHintsSenderAls.run(sender, fn);
+	try {
+		const chainFn = () => runMiddlewareChain(match.middlewareChain, ctx);
+		const middlewareResponse = await (async () => {
+			setMutableCookieContext(true);
+			try {
+				return await withSpan("timber.middleware", {}, () => detailed ? withTiming("mw", "middleware.ts", chainFn) : chainFn());
+			} finally {
+				setMutableCookieContext(false);
+			}
+		})();
+		if (middlewareResponse) return {
+			kind: "response",
+			phase: "middleware",
+			response: middlewareResponse
+		};
+		applyRequestHeaderOverlay(requestHeaderOverlay);
+		applyCookieJar(responseHeaders);
+		return runRenderPhase(config, req, match, responseHeaders, requestHeaderOverlay, renderContext);
+	} catch (error) {
+		if (error instanceof RedirectSignal) return {
+			kind: "redirect",
+			phase: "middleware",
+			signal: error
+		};
+		if (error instanceof DenySignal) return {
+			kind: "deny",
+			phase: "middleware",
+			signal: error
+		};
+		return {
+			kind: "error",
+			phase: "middleware",
+			error
+		};
+	}
 }
 /**
-* Send collected Link headers as a 103 Early Hints response.
-*
-* No-op if no sender is installed for the current request (e.g., on
-* Cloudflare where the CDN handles 103 automatically, or in dev mode).
-*
-* Non-fatal: errors from the sender are caught and silently ignored.
+* Run the render phase. Wraps the configured renderer in a span and a
+* timing scope, and translates thrown signals into outcome variants.
 */
-function sendEarlyHints103(links) {
-	if (!links.length) return;
-	const sender = earlyHintsSenderAls.getStore();
-	if (!sender) return;
+async function runRenderPhase(config, req, match, responseHeaders, requestHeaderOverlay, { canonicalPathname, interception }) {
+	const detailed = config.serverTiming === "detailed";
 	try {
-		sender(links);
-	} catch (err) {
-		swallow(err, "early hints 103 send failed");
+		const renderFn = () => config.render(req, match, responseHeaders, requestHeaderOverlay, interception);
+		return {
+			kind: "response",
+			phase: "render",
+			response: await withSpan("timber.render", { "http.route": canonicalPathname }, () => detailed ? withTiming("render", "RSC + SSR render", renderFn) : renderFn())
+		};
+	} catch (error) {
+		if (error instanceof DenySignal) return {
+			kind: "deny",
+			phase: "render",
+			signal: error
+		};
+		if (error instanceof RedirectSignal) return {
+			kind: "redirect",
+			phase: "render",
+			signal: error
+		};
+		return {
+			kind: "error",
+			phase: "render",
+			error
+		};
 	}
 }
-//#endregion
-//#region src/server/tree-builder.ts
-var REACT_COMPONENT_TYPE_MARKERS = /* @__PURE__ */ new Set([
-	Symbol.for("react.forward_ref"),
-	Symbol.for("react.memo"),
-	Symbol.for("react.lazy"),
-	Symbol.for("react.provider"),
-	Symbol.for("react.context"),
-	Symbol.for("react.suspense"),
-	Symbol.for("react.suspense_list"),
-	Symbol.for("react.client.reference")
-]);
 /**
-* Validate that a loaded module's `default` export is something React
-* accepts as the first argument to `createElement` — i.e. a valid component
-* type. React doesn't export `isValidElementType` (only `isValidElement`,
-* which checks for *elements*, not *component types*), so this mirrors
-* React's internal check:
-*
-*   - functions  → function or class components
-*   - objects with a `$$typeof` matching one of React's known component
-*     markers → exotic components (`memo`, `forwardRef`, `lazy`, context,
-*     suspense, client references via `@vitejs/plugin-rsc`)
-*
-* Strings (HTML tag names) are valid for `createElement` but never appear
-* as a route module's default export, so they're not recognized here.
+* Process a single request from canonicalization through phase dispatch.
 *
-* Anything else (numbers, plain config objects, JSON, etc.) is rejected so
-* the boundary wrapper is skipped rather than crashing inside React.
-*/
-function isValidElementType(value) {
-	if (typeof value === "function") return true;
-	if (typeof value !== "object" || value === null) return false;
-	const marker = value.$$typeof;
-	return typeof marker === "symbol" && REACT_COMPONENT_TYPE_MARKERS.has(marker);
-}
-/**
-* Build the unified element tree from a matched segment chain.
+* Stages: canonicalize → metadata routes → auto-sitemap → version skew →
+* route match → interception → early hints → param coercion → middleware →
+* render → outcome translation. Pre-routing short-circuits return Responses
+* directly; post-match dispatch goes through `outcomeToResponse`.
 *
-* Construction is bottom-up:
-*   1. Start with the page component (leaf segment)
-*   2. Wrap in status-code error boundaries (fallback chain)
-*   3. Wrap in AccessGate (if segment has access.ts)
-*   4. Pass as children to the segment's layout
-*   5. Repeat up the segment chain to root
+* Used both as the top-level entry (when no proxy.ts is configured) and as
+* the `next()` continuation passed to `runProxy()`.
 *
-* Parallel slots are resolved at each layout level and composed as named props.
+* @param pathIsCanonical When true, `path` has already been canonicalized by
+*   `createPipeline` — skip re-canonicalization to prevent double-decode.
+*   When false (default), runs canonicalize as a safety net for direct callers.
 */
-async function buildElementTree(config) {
-	const { segments, loadModule, createElement, errorBoundaryComponent } = config;
-	if (segments.length === 0) throw new Error("[timber] buildElementTree: empty segment chain");
-	const leaf = segments[segments.length - 1];
-	if (leaf.route && !leaf.page) return {
-		tree: null,
-		isApiRoute: true
-	};
-	const PageComponent = (leaf.page ? await loadModule(leaf.page) : null)?.default;
-	if (!PageComponent) throw new Error(`[timber] No page component found for route at ${leaf.urlPath}. Each route must have a page.tsx or route.ts.`);
-	let element = createElement(PageComponent, {});
-	for (let i = segments.length - 1; i >= 0; i--) {
-		const segment = segments[i];
-		element = await wrapWithErrorBoundaries(segment, element, loadModule, createElement, errorBoundaryComponent);
-		if (segment.access) {
-			const accessFn = (await loadModule(segment.access)).default;
-			element = createElement("timber:access-gate", {
-				accessFn,
-				segmentName: segment.segmentName,
-				children: element
+async function handleRequest(config, req, method, path, pathIsCanonical) {
+	const stripTrailingSlash = config.stripTrailingSlash ?? true;
+	let canonicalPathname;
+	if (pathIsCanonical) canonicalPathname = path;
+	else {
+		const result = canonicalize(path, stripTrailingSlash);
+		if (!result.ok) {
+			if (isDebug()) console.warn(`[timber] URL canonicalization rejected ${method} ${path} — responding with ${result.status}\n  This usually means the URL contains encoded separators (%2f, %5c),\n  null bytes (%00), path traversal (..), or malformed percent-encoding.`);
+			return new Response(null, { status: result.status });
+		}
+		canonicalPathname = result.pathname;
+	}
+	if (config.matchMetadataRoute) {
+		const metaMatch = config.matchMetadataRoute(canonicalPathname);
+		if (metaMatch) try {
+			if (metaMatch.isStatic) return await serveStaticMetadataFile(metaMatch);
+			setSegmentParams(metaMatch.segmentParams);
+			const mod = await loadModule(metaMatch.file);
+			if (typeof mod.default !== "function") {
+				if (isDebug()) console.warn(`[timber] Metadata route ${metaMatch.file} does not export a default function — responding with 500\n  Metadata routes must export a default function that returns the metadata content.`);
+				return new Response("Metadata route must export a default function", { status: 500 });
+			}
+			const handlerResult = await mod.default();
+			if (handlerResult instanceof Response) {
+				if (method === "HEAD") {
+					const headHeaders = new Headers(handlerResult.headers);
+					if (handlerResult.ok && !headHeaders.has("Cache-Control")) headHeaders.set("Cache-Control", "public, max-age=14400, must-revalidate");
+					return new Response(null, {
+						status: handlerResult.status,
+						statusText: handlerResult.statusText,
+						headers: headHeaders
+					});
+				}
+				const res = cloneWithMutableHeaders(handlerResult);
+				if (res.ok && !res.headers.has("Cache-Control")) res.headers.set("Cache-Control", "public, max-age=14400, must-revalidate");
+				return res;
+			}
+			const contentType = metaMatch.contentType;
+			let body;
+			if (typeof handlerResult === "string") body = handlerResult;
+			else if (contentType === "application/xml") body = serializeSitemap(handlerResult);
+			else if (contentType === "application/manifest+json") body = JSON.stringify(handlerResult, null, 2);
+			else body = String(handlerResult);
+			return new Response(body, {
+				status: 200,
+				headers: {
+					"Content-Type": `${contentType}; charset=utf-8`,
+					"Cache-Control": "public, max-age=14400, must-revalidate"
+				}
+			});
+		} catch (error) {
+			if (error instanceof RedirectSignal) return new Response(null, {
+				status: error.status,
+				headers: { Location: error.location }
 			});
+			if (error instanceof DenySignal) return new Response(null, { status: error.status });
+			logRenderError({
+				method,
+				path,
+				error
+			});
+			if (config.onPipelineError && error instanceof Error) config.onPipelineError(error, "metadata-route");
+			return new Response(null, { status: 500 });
 		}
-		if (segment.layout) {
-			const LayoutComponent = (await loadModule(segment.layout)).default;
-			if (LayoutComponent) {
-				const slotProps = {};
-				const slotNames = Object.keys(segment.slots);
-				if (slotNames.length > 0) for (const slotName of slotNames) {
-					const slotNode = segment.slots[slotName];
-					slotProps[slotName] = await buildSlotElement(slotNode, loadModule, createElement, errorBoundaryComponent);
+	}
+	if (config.autoSitemapHandler) try {
+		const sitemapResponse = await config.autoSitemapHandler(canonicalPathname);
+		if (sitemapResponse) return cloneWithMutableHeaders(sitemapResponse);
+	} catch (error) {
+		logRenderError({
+			method,
+			path,
+			error
+		});
+		if (config.onPipelineError && error instanceof Error) config.onPipelineError(error, "auto-sitemap");
+		return new Response(null, { status: 500 });
+	}
+	const isRscRequest = (req.headers.get("Accept") ?? "").includes("text/x-component");
+	if (isRscRequest) {
+		if (!checkVersionSkew(req).ok) {
+			const reloadHeaders = new Headers();
+			applyReloadHeaders(reloadHeaders);
+			return new Response(null, {
+				status: 204,
+				headers: reloadHeaders
+			});
+		}
+	}
+	let match = config.matchRoute(canonicalPathname);
+	let interception;
+	if (isRscRequest && config.interceptionRewrites?.length) {
+		const rawSourceUrl = req.headers.get("X-Timber-URL");
+		const validatedSourceUrl = rawSourceUrl ? validateInterceptionHeader(rawSourceUrl, stripTrailingSlash) : null;
+		if (validatedSourceUrl) {
+			const intercepted = findInterceptionMatch(canonicalPathname, validatedSourceUrl, config.interceptionRewrites);
+			if (intercepted) {
+				const sourceMatch = config.matchRoute(intercepted.sourcePathname);
+				if (sourceMatch) {
+					match = sourceMatch;
+					interception = { targetPathname: canonicalPathname };
 				}
-				element = createElement(LayoutComponent, {
-					...slotProps,
-					children: element
-				});
 			}
 		}
 	}
-	return {
-		tree: element,
-		isApiRoute: false
-	};
+	if (!match) {
+		if (isDebug()) console.warn(`[timber] No route matched for pathname: ${canonicalPathname}\n  Input path: ${path}\n  Method: ${method}`);
+		if (config.renderNoMatch) {
+			const responseHeaders = new Headers();
+			return cloneWithMutableHeaders(await config.renderNoMatch(req, responseHeaders));
+		}
+		return new Response(null, { status: 404 });
+	}
+	const responseHeaders = new Headers();
+	const requestHeaderOverlay = new Headers();
+	responseHeaders.set("Cache-Control", "private, no-cache, no-store, max-age=0, must-revalidate");
+	const leafSegment = match.segments[match.segments.length - 1];
+	const isApiRoute = leafSegment?.route && !leafSegment?.page;
+	if (config.earlyHints && !isRscRequest && !isApiRoute) try {
+		await config.earlyHints(match, req, responseHeaders);
+	} catch (err) {
+		swallow(err, "early hints hook threw");
+	}
+	match.rawSegmentParams = { ...match.segmentParams };
+	try {
+		await coerceSegmentParams(match);
+	} catch (error) {
+		if (error instanceof ParamCoercionError) {
+			if (isDebug()) {
+				const segmentChain = match.segments.map((s) => s.segmentName || "/").join(" → ");
+				console.warn(`[timber] Param coercion failed for ${method} ${canonicalPathname} — responding with 404\n  Matched segments: ${segmentChain}\n  Error: ${error.message}\n  This usually means a params.ts codec rejected the URL params.\n  Check that all fields in defineSegmentParams() are optional for params\n  that don't appear at every route depth (e.g. year, month, day).`);
+			}
+			const leafSegment = match.segments[match.segments.length - 1];
+			if (leafSegment.route && !leafSegment.page) return new Response(null, { status: 404 });
+			if (config.renderNoMatch) return cloneWithMutableHeaders(await config.renderNoMatch(req, responseHeaders));
+			return new Response(null, { status: 404 });
+		}
+		throw error;
+	}
+	setSegmentParams(match.segmentParams);
+	const segmentPath = match.segments.map((s) => s.segmentName).filter(Boolean).join("/") || "/";
+	setMatchedSegmentPath(segmentPath.startsWith("/") ? segmentPath : `/${segmentPath}`);
+	return outcomeToResponse(config, match.middlewareChain.length > 0 ? await runMiddlewarePhase(config, req, match, responseHeaders, requestHeaderOverlay, {
+		canonicalPathname,
+		interception
+	}) : await runRenderPhase(config, req, match, responseHeaders, requestHeaderOverlay, {
+		canonicalPathname,
+		interception
+	}), {
+		req,
+		method,
+		path,
+		responseHeaders,
+		match
+	});
 }
+//#endregion
+//#region src/server/pipeline.ts
 /**
-* Build the element tree for a parallel slot.
+* Create the request handler from a pipeline configuration.
 *
-* Slots have their own access.ts (SlotAccessGate) and error boundaries.
-* On access denial: denied.tsx → default.tsx → null (graceful degradation).
+* Returns a function that processes an incoming Request through all pipeline
+* stages and produces a Response. This is the top-level entry point for the
+* server. The body is intentionally small — phase logic lives in
+* `pipeline-phases.ts`. This function only owns the per-request setup that
+* has to wrap the entire dispatch: trace ID, request context ALS, span
+* scope, Server-Timing header emission, and the active-request counter.
 */
-async function buildSlotElement(slotNode, loadModule, createElement, errorBoundaryComponent) {
-	const PageComponent = (slotNode.page ? await loadModule(slotNode.page) : null)?.default;
-	const DefaultComponent = (slotNode.default ? await loadModule(slotNode.default) : null)?.default;
-	if (!PageComponent) return DefaultComponent ? createElement(DefaultComponent, {}) : null;
-	let element = createElement(PageComponent, {});
-	element = await wrapWithErrorBoundaries(slotNode, element, loadModule, createElement, errorBoundaryComponent);
-	if (slotNode.access) {
-		const accessFn = (await loadModule(slotNode.access)).default;
-		const DeniedComponent = (slotNode.denied ? await loadModule(slotNode.denied) : null)?.default ?? null;
-		const defaultFallback = DefaultComponent ? createElement(DefaultComponent, {}) : null;
-		element = createElement("timber:slot-access-gate", {
-			accessFn,
-			DeniedComponent,
-			slotName: slotNode.segmentName.replace(/^@/, ""),
-			createElement,
-			defaultFallback,
-			children: element
+function createPipeline(config) {
+	const proxyResolver = makeProxyResolver(config.proxy);
+	const slowRequestMs = config.slowRequestMs ?? 3e3;
+	const serverTiming = config.serverTiming ?? "total";
+	let activeRequests = 0;
+	const pipelineFn = async (req) => {
+		const url = new URL(req.url);
+		const method = req.method;
+		const path = url.pathname;
+		const startTime = performance.now();
+		activeRequests++;
+		return runWithTraceId(generateTraceId(), async () => {
+			return runWithRequestContext(req, async () => {
+				const runRequest = async () => {
+					logRequestReceived({
+						method,
+						path
+					});
+					const response = await withSpan("http.server.request", {
+						"http.request.method": method,
+						"url.path": path
+					}, async () => {
+						const otelIds = await getOtelTraceId();
+						if (otelIds) replaceTraceId(otelIds.traceId, otelIds.spanId);
+						const stripTrailingSlash = config.stripTrailingSlash ?? true;
+						const canonResult = canonicalize(url.pathname, stripTrailingSlash);
+						if (!canonResult.ok) {
+							if (isDebug()) console.warn(`[timber] URL canonicalization rejected ${method} ${url.pathname} — responding with ${canonResult.status}\n  This usually means the URL contains encoded separators (%2f, %5c),\n  null bytes (%00), path traversal (..), or malformed percent-encoding.`);
+							return new Response(null, { status: canonResult.status });
+						}
+						const canonicalPath = canonResult.pathname;
+						let canonicalReq = req;
+						if (url.pathname !== canonicalPath) {
+							const canonicalUrl = new URL(req.url);
+							canonicalUrl.pathname = canonicalPath;
+							canonicalReq = new Request(canonicalUrl.toString(), req);
+						}
+						const innerHandler = async () => {
+							if (config.dispatchAction) {
+								const actionResult = await config.dispatchAction(canonicalReq, canonicalPath, pipelineFn);
+								if (actionResult) return actionResult;
+							}
+							return handleRequest(config, canonicalReq, method, canonicalPath, true);
+						};
+						let result;
+						if (proxyResolver) result = await outcomeToResponse(config, await runProxyPhase(config, proxyResolver, canonicalReq, method, canonicalPath, innerHandler), {
+							req: canonicalReq,
+							method,
+							path: canonicalPath
+						});
+						else result = await innerHandler();
+						await setSpanAttribute("http.response.status_code", result.status);
+						const varyTokens = ["Accept"];
+						if (config.interceptionRewrites?.length) varyTokens.push("X-Timber-URL");
+						const existingVary = result.headers.get("Vary");
+						const existingTokens = existingVary ? existingVary.toLowerCase().split(",").map((t) => t.trim()) : [];
+						const newTokens = varyTokens.filter((t) => !existingTokens.includes(t.toLowerCase()));
+						if (newTokens.length > 0) result.headers.set("Vary", existingVary ? `${existingVary}, ${newTokens.join(", ")}` : newTokens.join(", "));
+						if (serverTiming === "detailed") {
+							const timingHeader = getServerTimingHeader();
+							if (timingHeader) result.headers.set("Server-Timing", timingHeader);
+						} else if (serverTiming === "total") {
+							const totalMs = Math.round(performance.now() - startTime);
+							result.headers.set("Server-Timing", `total;dur=${totalMs}`);
+						}
+						if (serverTiming === "detailed" && result.body) result = new Response(wrapResponseWithStreamTiming(result.body, startTime), {
+							status: result.status,
+							statusText: result.statusText,
+							headers: result.headers
+						});
+						return result;
+					});
+					const durationMs = Math.round(performance.now() - startTime);
+					const status = response.status;
+					const concurrency = activeRequests;
+					activeRequests--;
+					logRequestCompleted({
+						method,
+						path,
+						status,
+						durationMs,
+						concurrency
+					});
+					if (slowRequestMs > 0 && durationMs > slowRequestMs) logSlowRequest({
+						method,
+						path,
+						durationMs,
+						threshold: slowRequestMs,
+						concurrency
+					});
+					return response;
+				};
+				return serverTiming === "detailed" ? runWithTimingCollector(runRequest) : runRequest();
+			});
 		});
-	}
-	return element;
-}
-/** MDX/markdown extensions — these are server components that cannot be passed as function props. */
-var MDX_EXTENSIONS = /* @__PURE__ */ new Set(["mdx", "md"]);
-/**
-* Check if a route file is an MDX/markdown file based on its extension.
-* MDX components are server components by default and cannot cross the
-* RSC→client boundary as function props. They must be pre-rendered as
-* elements and passed as fallbackElement instead of fallbackComponent.
-*/
-function isMdxFile(file) {
-	return MDX_EXTENSIONS.has(file.extension);
+	};
+	return pipelineFn;
 }
+//#endregion
+//#region src/server/build-manifest.ts
 /**
-* Wrap an element with error boundaries from a segment's status-code files.
-*
-* Wrapping order (innermost to outermost):
-*   1. Specific status files (503.tsx, 429.tsx, etc.)
-*   2. Category catch-alls (4xx.tsx, 5xx.tsx)
-*   3. error.tsx (general error boundary)
-*
-* This creates the fallback chain described in design/10-error-handling.md.
+* Collect all CSS files needed for a matched route's segment chain.
 *
-* MDX status files are server components and cannot be passed as function
-* props to TimberErrorBoundary (a 'use client' component). Instead, they
-* are pre-rendered as elements and passed as fallbackElement. The error
-* boundary renders the element directly when an error is caught.
-* See TIM-503.
+* Walks segments root → leaf, collecting CSS for each layout and page.
+* Deduplicates while preserving order (root layout CSS first).
 */
-async function wrapWithErrorBoundaries(segment, element, loadModule, createElement, errorBoundaryComponent) {
-	if (segment.statusFiles) {
-		for (const [key, file] of Object.entries(segment.statusFiles)) if (key !== "4xx" && key !== "5xx") {
-			const status = parseInt(key, 10);
-			if (!isNaN(status)) {
-				const mod = await loadModule(file);
-				const Component = isValidElementType(mod.default) ? mod.default : null;
-				if (Component) element = createElement(errorBoundaryComponent, isMdxFile(file) ? {
-					fallbackElement: createElement(Component, { status }),
-					status,
-					children: element
-				} : {
-					fallbackComponent: Component,
-					status,
-					children: element
-				});
-			}
-		}
-		for (const [key, file] of Object.entries(segment.statusFiles)) if (key === "4xx" || key === "5xx") {
-			const mod = await loadModule(file);
-			const Component = isValidElementType(mod.default) ? mod.default : null;
-			if (Component) {
-				const categoryStatus = key === "4xx" ? 400 : 500;
-				element = createElement(errorBoundaryComponent, isMdxFile(file) ? {
-					fallbackElement: createElement(Component, {}),
-					status: categoryStatus,
-					children: element
-				} : {
-					fallbackComponent: Component,
-					status: categoryStatus,
-					children: element
-				});
-			}
+function collectRouteCss(segments, manifest) {
+	const seen = /* @__PURE__ */ new Set();
+	const result = [];
+	for (const segment of segments) for (const file of [segment.layout, segment.page]) {
+		if (!file) continue;
+		const cssFiles = manifest.css[file.filePath];
+		if (!cssFiles) continue;
+		for (const url of cssFiles) if (!seen.has(url)) {
+			seen.add(url);
+			result.push(url);
 		}
 	}
-	if (segment.error) {
-		const errorModule = await loadModule(segment.error);
-		const ErrorComponent = isValidElementType(errorModule.default) ? errorModule.default : null;
-		if (ErrorComponent) element = createElement(errorBoundaryComponent, isMdxFile(segment.error) ? {
-			fallbackElement: createElement(ErrorComponent, {}),
-			children: element
-		} : {
-			fallbackComponent: ErrorComponent,
-			children: element
-		});
-	}
-	return element;
+	return result;
 }
-//#endregion
-//#region src/server/csrf.ts
-/** HTTP methods that are considered safe (no mutation). */
-var SAFE_METHODS = /* @__PURE__ */ new Set([
-	"GET",
-	"HEAD",
-	"OPTIONS"
-]);
-/**
-* Derive the request's scheme from trusted sources.
-*
-* Priority:
-* 1. X-Forwarded-Proto (set by reverse proxies / load balancers)
-* 2. Request URL protocol
+/**
+* Collect all font entries needed for a matched route's segment chain.
 *
-* Falls back to 'https' (fail closed) if neither is available.
+* Walks segments root → leaf, collecting fonts for each layout and page.
+* Deduplicates by href while preserving order.
 */
-function deriveRequestScheme(req) {
-	const forwarded = req.headers.get("X-Forwarded-Proto");
-	if (forwarded) {
-		const proto = forwarded.split(",")[0].trim().toLowerCase();
-		if (proto === "http" || proto === "https") return proto;
-	}
-	try {
-		return new URL(req.url).protocol.replace(":", "");
-	} catch {
-		return "https";
+function collectRouteFonts(segments, manifest) {
+	const seen = /* @__PURE__ */ new Set();
+	const result = [];
+	for (const segment of segments) for (const file of [segment.layout, segment.page]) {
+		if (!file) continue;
+		const fonts = manifest.fonts[file.filePath];
+		if (!fonts) continue;
+		for (const entry of fonts) if (!seen.has(entry.href)) {
+			seen.add(entry.href);
+			result.push(entry);
+		}
 	}
+	return result;
 }
 /**
-* Validate the Origin header against the request's full origin
-* (scheme + host + port).
-*
-* For mutation methods (POST, PUT, PATCH, DELETE):
-* - If `csrf: false`, skip validation.
-* - If `allowedOrigins` is set, Origin must match one exactly (no wildcards).
-* - Otherwise, Origin must match the derived request origin.
+* Collect modulepreload URLs for a matched route's segment chain.
 *
-* Safe methods (GET, HEAD, OPTIONS) always pass.
+* Walks segments root → leaf, collecting transitive JS dependencies
+* for each layout and page. Deduplicates across segments.
 */
-function validateCsrf(req, config) {
-	if (SAFE_METHODS.has(req.method)) return { ok: true };
-	if (config.csrf === false) return { ok: true };
-	const origin = req.headers.get("Origin");
-	if (!origin) return {
-		ok: false,
-		status: 403
-	};
-	if (config.allowedOrigins) return config.allowedOrigins.includes(origin) ? { ok: true } : {
-		ok: false,
-		status: 403
-	};
-	const host = req.headers.get("Host");
-	if (!host) return {
-		ok: false,
-		status: 403
-	};
-	let originOrigin;
-	try {
-		originOrigin = new URL(origin).origin;
-	} catch {
-		return {
-			ok: false,
-			status: 403
-		};
-	}
-	const scheme = deriveRequestScheme(req);
-	let expectedOrigin;
-	try {
-		expectedOrigin = new URL(`${scheme}://${host}`).origin;
-	} catch {
-		return {
-			ok: false,
-			status: 403
-		};
+function collectRouteModulepreloads(segments, manifest) {
+	const seen = /* @__PURE__ */ new Set();
+	const result = [];
+	for (const segment of segments) for (const file of [segment.layout, segment.page]) {
+		if (!file) continue;
+		const preloads = manifest.modulepreload[file.filePath];
+		if (!preloads) continue;
+		for (const url of preloads) if (!seen.has(url)) {
+			seen.add(url);
+			result.push(url);
+		}
 	}
-	return originOrigin === expectedOrigin ? { ok: true } : {
-		ok: false,
-		status: 403
-	};
+	return result;
 }
 //#endregion
-//#region src/server/body-limits.ts
-var KB = 1024;
-var MB = 1024 * KB;
-var GB = 1024 * MB;
-var DEFAULT_LIMITS = {
-	actionBodySize: 1 * MB,
-	uploadBodySize: 10 * MB,
-	maxFields: 100
-};
-var SIZE_PATTERN = /^(\d+(?:\.\d+)?)\s*(kb|mb|gb)?$/i;
-/** Parse a human-readable size string ("1mb", "512kb", "1024") into bytes. */
-function parseBodySize(size) {
-	const match = SIZE_PATTERN.exec(size.trim());
-	if (!match) throw new Error(`Invalid body size format: "${size}". Expected format like "1mb", "512kb", or "1024".`);
-	const value = Number.parseFloat(match[1]);
-	const unit = (match[2] ?? "").toLowerCase();
-	switch (unit) {
-		case "kb": return Math.floor(value * KB);
-		case "mb": return Math.floor(value * MB);
-		case "gb": return Math.floor(value * GB);
-		case "": return Math.floor(value);
-		default: throw new Error(`Unknown size unit: "${unit}"`);
-	}
-}
-/** Strict integer pattern: one or more digits, nothing else. */
-var STRICT_INTEGER_RE = /^\d+$/;
-/** Check whether a request body exceeds the configured size limit (stateless, no ALS). */
-function enforceBodyLimits(req, kind, config) {
-	const contentLength = req.headers.get("Content-Length");
-	if (!contentLength) return {
-		ok: false,
-		status: 411
-	};
-	const trimmed = contentLength.trim();
-	if (!STRICT_INTEGER_RE.test(trimmed)) return {
-		ok: false,
-		status: 411
-	};
-	return Number.parseInt(trimmed, 10) <= resolveLimit(kind, config) ? { ok: true } : {
-		ok: false,
-		status: 413
-	};
-}
+//#region src/server/early-hints.ts
 /**
-* Resolve the byte limit for a given body kind, using config overrides or defaults.
+* 103 Early Hints utilities.
+*
+* Early Hints are sent before the final response to let the browser
+* start fetching critical resources (CSS, fonts, JS) while the server
+* is still rendering.
+*
+* The framework collects hints from two sources:
+* 1. Build manifest — CSS, fonts, and JS chunks known at route-match time
+* 2. ctx.earlyHints() — explicit hints added by middleware or route handlers
+*
+* Both are emitted as Link headers. Cloudflare CDN automatically converts
+* Link headers into 103 Early Hints responses.
+*
+* Design docs: 02-rendering-pipeline.md §"Early Hints (103)"
 */
-function resolveLimit(kind, config) {
-	const userLimits = config.limits;
-	if (kind === "action") return userLimits?.actionBodySize ? parseBodySize(userLimits.actionBodySize) : DEFAULT_LIMITS.actionBodySize;
-	return userLimits?.uploadBodySize ? parseBodySize(userLimits.uploadBodySize) : DEFAULT_LIMITS.uploadBodySize;
-}
-//#endregion
-//#region src/server/route-handler.ts
-/** All recognized HTTP method export names. */
-var HTTP_METHODS = [
-	"GET",
-	"POST",
-	"PUT",
-	"PATCH",
-	"DELETE",
-	"HEAD",
-	"OPTIONS"
-];
 /**
-* Resolve the full list of allowed methods for a route module.
+* Format a single EarlyHint as a Link header value.
 *
-* Includes:
-* - All explicitly exported methods
-* - HEAD (implicit when GET is exported)
-* - OPTIONS (always implicit)
+* Attribute order: `as` before `rel` to match Cloudflare CDN's cached
+* Early Hints format. Cloudflare caches Link headers from 200 responses
+* and re-emits them as 103 Early Hints on subsequent requests. If our
+* attribute order differs from Cloudflare's cached copy, the browser
+* sees two preload headers for the same URL (different attribute order)
+* and warns "Preload was ignored." Matching the order ensures the
+* browser deduplicates them correctly.
+*
+* Examples:
+*   `</styles/root.css>; as=style; rel=preload`
+*   `</fonts/inter.woff2>; as=font; rel=preload; crossorigin=anonymous`
+*   `</_timber/client.js>; rel=modulepreload`
+*   `<https://fonts.googleapis.com>; rel=preconnect`
 */
-function resolveAllowedMethods(mod) {
-	const methods = [];
-	for (const method of HTTP_METHODS) {
-		if (method === "HEAD" || method === "OPTIONS") continue;
-		if (mod[method]) methods.push(method);
+function formatLinkHeader(hint) {
+	if (hint.as !== void 0) {
+		let value = `<${hint.href}>; as=${hint.as}; rel=${hint.rel}`;
+		if (hint.crossOrigin !== void 0) value += `; crossorigin=${hint.crossOrigin}`;
+		if (hint.fetchPriority !== void 0) value += `; fetchpriority=${hint.fetchPriority}`;
+		return value;
 	}
-	if (mod.GET && !mod.HEAD) methods.push("HEAD");
-	else if (mod.HEAD) methods.push("HEAD");
-	if (!mod.OPTIONS) methods.push("OPTIONS");
-	else methods.push("OPTIONS");
-	return methods;
+	let value = `<${hint.href}>; rel=${hint.rel}`;
+	if (hint.crossOrigin !== void 0) value += `; crossorigin=${hint.crossOrigin}`;
+	if (hint.fetchPriority !== void 0) value += `; fetchpriority=${hint.fetchPriority}`;
+	return value;
 }
 /**
-* Handle an incoming request against a route.ts module.
+* Collect all Link header strings for a matched route's segment chain.
 *
-* Dispatches to the named method handler, auto-generates 405/OPTIONS,
-* and merges response headers from ctx.headers.
+* Walks the build manifest to emit hints for:
+* - CSS stylesheets (as=style; rel=preload)
+* - Font assets (as=font; rel=preload; crossorigin)
+* - JS modulepreload hints (rel=modulepreload) — unless skipJs is set
+*
+* Returns formatted Link header strings, deduplicated by URL, root → leaf order.
+* Returns an empty array in dev mode (manifest is empty).
 */
-async function handleRouteRequest(mod, ctx) {
-	const method = ctx.req.method.toUpperCase();
-	const allowHeader = resolveAllowedMethods(mod).join(", ");
-	if (method === "OPTIONS") {
-		if (mod.OPTIONS) return runHandler(mod.OPTIONS, ctx);
-		return new Response(null, {
-			status: 204,
-			headers: { Allow: allowHeader }
-		});
-	}
-	if (method === "HEAD") {
-		if (mod.HEAD) return runHandler(mod.HEAD, ctx);
-		if (mod.GET) {
-			const res = await runHandler(mod.GET, ctx);
-			return new Response(null, {
-				status: res.status,
-				headers: res.headers
-			});
+function collectEarlyHintHeaders(segments, manifest, options) {
+	const result = [];
+	const seenUrls = /* @__PURE__ */ new Set();
+	const add = (url, header) => {
+		if (!seenUrls.has(url)) {
+			seenUrls.add(url);
+			result.push(header);
 		}
-	}
-	const handler = mod[method];
-	if (!handler) return new Response(null, {
-		status: 405,
-		headers: { Allow: allowHeader }
-	});
-	return runHandler(handler, ctx);
+	};
+	for (const url of collectRouteCss(segments, manifest)) add(url, formatLinkHeader({
+		href: url,
+		rel: "preload",
+		as: "style"
+	}));
+	for (const font of collectRouteFonts(segments, manifest)) add(font.href, formatLinkHeader({
+		href: font.href,
+		rel: "preload",
+		as: "font",
+		crossOrigin: "anonymous"
+	}));
+	if (!options?.skipJs) for (const url of collectRouteModulepreloads(segments, manifest)) add(url, formatLinkHeader({
+		href: url,
+		rel: "modulepreload"
+	}));
+	return result;
 }
+//#endregion
+//#region src/server/early-hints-sender.ts
 /**
-* Run a handler, merge ctx.headers into the response, and catch errors.
+* Per-request 103 Early Hints sender — ALS bridge for platform adapters.
+*
+* The pipeline collects Link headers for CSS, fonts, and JS chunks at
+* route-match time. On platforms that support it (Node.js v18.11+, Bun),
+* the adapter can send these as a 103 Early Hints interim response before
+* the final response is ready.
+*
+* This module provides an ALS-based bridge: the generated entry point
+* (e.g., the Nitro entry) wraps the handler with `runWithEarlyHintsSender`,
+* binding a per-request sender function. The pipeline calls
+* `sendEarlyHints103()` to fire the 103 if a sender is available.
+*
+* On platforms where 103 is handled at the CDN level (e.g., Cloudflare
+* converts Link headers into 103 automatically), no sender is installed
+* and `sendEarlyHints103()` is a no-op.
+*
+* Design doc: 02-rendering-pipeline.md §"Early Hints (103)"
 */
-async function runHandler(handler, ctx) {
-	try {
-		return mergeResponseHeaders(await handler(ctx), ctx.headers);
-	} catch (error) {
-		if (error instanceof DenySignal || error instanceof RedirectSignal) throw error;
-		logRouteError({
-			method: ctx.req.method,
-			path: new URL(ctx.req.url).pathname,
-			error
-		});
-		return new Response(null, { status: 500 });
-	}
-}
 /**
-* Merge response headers from ctx.headers into the handler's response.
-* ctx.headers (set by middleware or the handler) are applied to the final response.
-* Handler-set headers take precedence over ctx.headers.
+* Run a function with a per-request early hints sender installed.
+*
+* Called by generated entry points (e.g., Nitro node-server/bun) to
+* bind the platform's writeEarlyHints capability for the request duration.
 */
-function mergeResponseHeaders(res, ctxHeaders) {
-	let hasCtxHeaders = false;
-	ctxHeaders.forEach(() => {
-		hasCtxHeaders = true;
-	});
-	if (!hasCtxHeaders) return res;
-	const merged = new Headers();
-	ctxHeaders.forEach((value, key) => {
-		if (key.toLowerCase() === "set-cookie") merged.append(key, value);
-		else merged.set(key, value);
-	});
-	const resCookies = res.headers.getSetCookie();
-	for (const cookie of resCookies) merged.append("Set-Cookie", cookie);
-	res.headers.forEach((value, key) => {
-		if (key.toLowerCase() !== "set-cookie") merged.set(key, value);
-	});
-	return new Response(res.body, {
-		status: res.status,
-		statusText: res.statusText,
-		headers: merged
-	});
+function runWithEarlyHintsSender(sender, fn) {
+	return earlyHintsSenderAls.run(sender, fn);
 }
-//#endregion
-//#region src/server/render-timeout.ts
 /**
-* Render timeout utilities for SSR streaming pipeline.
+* Send collected Link headers as a 103 Early Hints response.
 *
-* Provides a RenderTimeoutError class and a helper to create
-* timeout-guarded AbortSignals. Used to defend against hung RSC
-* streams and infinite SSR renders.
+* No-op if no sender is installed for the current request (e.g., on
+* Cloudflare where the CDN handles 103 automatically, or in dev mode).
 *
-* Design doc: 02-rendering-pipeline.md §"Streaming Constraints"
-*/
-/**
-* Error thrown when an SSR render or RSC stream read exceeds the
-* configured timeout. Callers can check `instanceof RenderTimeoutError`
-* to distinguish timeout from other errors and return a 504 or close
-* the connection cleanly.
+* Non-fatal: errors from the sender are caught and silently ignored.
 */
-var RenderTimeoutError = class extends Error {
-	timeoutMs;
-	constructor(timeoutMs, context) {
-		const message = context ? `Render timeout after ${timeoutMs}ms: ${context}` : `Render timeout after ${timeoutMs}ms`;
-		super(message);
-		this.name = "RenderTimeoutError";
-		this.timeoutMs = timeoutMs;
+function sendEarlyHints103(links) {
+	if (!links.length) return;
+	const sender = earlyHintsSenderAls.getStore();
+	if (!sender) return;
+	try {
+		sender(links);
+	} catch (err) {
+		swallow(err, "early hints 103 send failed");
 	}
-};
+}
 //#endregion
-//#region src/server/prebuilt/cache-key.ts
+//#region src/server/tree-builder.ts
+var REACT_COMPONENT_TYPE_MARKERS = /* @__PURE__ */ new Set([
+	Symbol.for("react.forward_ref"),
+	Symbol.for("react.memo"),
+	Symbol.for("react.lazy"),
+	Symbol.for("react.provider"),
+	Symbol.for("react.context"),
+	Symbol.for("react.suspense"),
+	Symbol.for("react.suspense_list"),
+	Symbol.for("react.client.reference")
+]);
 /**
-* Component cache-key hashing for prebuilt (cache.component) entries.
+* Validate that a loaded module's `default` export is something React
+* accepts as the first argument to `createElement` — i.e. a valid component
+* type. React doesn't export `isValidElementType` (only `isValidElement`,
+* which checks for *elements*, not *component types*), so this mirrors
+* React's internal check:
 *
-* Key: `sha256(canonicalJson({ props, params })).slice(0, 16)` — see
-* design/44-render-at-build-time.md §Cache Key. Both the request-time
-* lookup (prebuilt-runtime.ts) and the post-build capture pass (TIM-1119)
-* MUST use this exact function, or build artifacts become unaddressable.
+*   - functions  → function or class components
+*   - objects with a `$$typeof` matching one of React's known component
+*     markers → exotic components (`memo`, `forwardRef`, `lazy`, context,
+*     suspense, client references via `@vitejs/plugin-rsc`)
 *
-* THE IDENTITY CONTRACT (design/44 §Cache Key): cache identity is **JSON
-* value semantics** — two inputs are the same entry iff they are the same
-* JSON value. This is an ALLOWLIST, not a denylist: a value participates
-* in caching iff it is plain JSON data — null, boolean, finite number,
-* string, dense array, or a plain `Object.prototype` object with only
-* enumerable string-keyed data properties — plus `undefined` and `-0`,
-* which hash as distinct sentinels because flight preserves them. Every
-* value outside that domain (functions, symbols, bigints, accessors,
-* hidden or symbol-keyed properties, non-`Object.prototype` prototypes
-* including null, aliased references, sparse arrays, cycles, non-finite
-* numbers) is UNKEYABLE by definition: `computeComponentCacheKey` returns
-* null and the caller renders live — slower, never wrong.
+* Strings (HTML tag names) are valid for `createElement` but never appear
+* as a route module's default export, so they're not recognized here.
 *
-* The line between rejected and declared-out-of-domain: values are
-* REJECTED when the JSON projection itself would be ambiguous or lossy
-* (hidden/symbol/non-enumerable properties, accessors, exotic
-* prototypes). Observable state that leaves the projection intact — key
-* order, reference identity, descriptor metadata (writable/configurable,
-* frozen/sealed/extensible), proxy behavior — is DECLARED outside
-* cache.component's supported input domain rather than rejected:
-* key-order insensitivity is required for determinism, and rejecting
-* frozen objects would unkey ubiquitous legitimate inputs
-* (Object.freeze'd config props) to defend against components that
-* render differently based on property attributes.
+* Anything else (numbers, plain config objects, JSON, etc.) is rejected so
+* the boundary wrapper is skipped rather than crashing inside React.
+*/
+function isValidElementType(value) {
+	if (typeof value === "function") return true;
+	if (typeof value !== "object" || value === null) return false;
+	const marker = value.$$typeof;
+	return typeof marker === "symbol" && REACT_COMPONENT_TYPE_MARKERS.has(marker);
+}
+/**
+* Build the unified element tree from a matched segment chain.
 *
-* Two hard rules for this walk itself: it must be TOTAL (never throw
-* anything but UnkeyableValueError) and SIDE-EFFECT-FREE (descriptor
-* reads only; never invoke user code such as getters).
+* Construction is bottom-up:
+*   1. Start with the page component (leaf segment)
+*   2. Wrap in status-code error boundaries (fallback chain)
+*   3. Wrap in AccessGate (if segment has access.ts)
+*   4. Pass as children to the segment's layout
+*   5. Repeat up the segment chain to root
 *
-* Object keys sort recursively so `{a, b}` and `{b, a}` hash identically
-* (design/13-security.md checklist #14 — cache key determinism; key order
-* is deliberately NOT part of identity).
+* Parallel slots are resolved at each layout level and composed as named props.
 */
-var UnkeyableValueError = class extends Error {};
-function canonicalize$1(value, seen) {
-	if (value === null) return "null";
-	switch (typeof value) {
-		case "string": return JSON.stringify(value);
-		case "boolean": return value ? "true" : "false";
-		case "number":
-			if (!Number.isFinite(value)) throw new UnkeyableValueError("non-finite number");
-			return Object.is(value, -0) ? "-0" : String(value);
-		case "object": break;
-		case "undefined": return "undefined";
-		default: throw new UnkeyableValueError(`unsupported type: ${typeof value}`);
-	}
-	const obj = value;
-	if (seen.has(obj)) throw new UnkeyableValueError("repeated object reference (cycle or alias)");
-	seen.add(obj);
-	if (Object.getOwnPropertySymbols(obj).length > 0) throw new UnkeyableValueError("symbol-keyed property");
-	{
-		if (Array.isArray(obj)) {
-			if (Object.getOwnPropertyNames(obj).length !== obj.length + 1) throw new UnkeyableValueError("non-index array property");
-			const parts = [];
-			for (let i = 0; i < obj.length; i++) {
-				const desc = Object.getOwnPropertyDescriptor(obj, i);
-				if (desc === void 0) throw new UnkeyableValueError("sparse array hole");
-				if (desc.get !== void 0 || desc.set !== void 0) throw new UnkeyableValueError("accessor property");
-				if (!desc.enumerable) throw new UnkeyableValueError("non-enumerable array element");
-				parts.push(canonicalize$1(desc.value, seen));
-			}
-			return "[" + parts.join(",") + "]";
+async function buildElementTree(config) {
+	const { segments, loadModule, createElement, errorBoundaryComponent } = config;
+	if (segments.length === 0) throw new Error("[timber] buildElementTree: empty segment chain");
+	const leaf = segments[segments.length - 1];
+	if (leaf.route && !leaf.page) return {
+		tree: null,
+		isApiRoute: true
+	};
+	const PageComponent = (leaf.page ? await loadModule(leaf.page) : null)?.default;
+	if (!PageComponent) throw new Error(`[timber] No page component found for route at ${leaf.urlPath}. Each route must have a page.tsx or route.ts.`);
+	let element = createElement(PageComponent, {});
+	for (let i = segments.length - 1; i >= 0; i--) {
+		const segment = segments[i];
+		element = await wrapWithErrorBoundaries(segment, element, loadModule, createElement, errorBoundaryComponent);
+		if (segment.access) {
+			const accessFn = (await loadModule(segment.access)).default;
+			element = createElement("timber:access-gate", {
+				accessFn,
+				segmentName: segment.segmentName,
+				children: element
+			});
 		}
-		if (Object.getPrototypeOf(obj) !== Object.prototype) throw new UnkeyableValueError("non-plain object");
-		const keys = Object.keys(obj).sort();
-		if (keys.length !== Object.getOwnPropertyNames(obj).length) throw new UnkeyableValueError("non-enumerable property");
-		const parts = [];
-		for (const key of keys) {
-			const desc = Object.getOwnPropertyDescriptor(obj, key);
-			if (desc.get !== void 0 || desc.set !== void 0) throw new UnkeyableValueError("accessor property");
-			parts.push(JSON.stringify(key) + ":" + canonicalize$1(desc.value, seen));
+		if (segment.layout) {
+			const LayoutComponent = (await loadModule(segment.layout)).default;
+			if (LayoutComponent) {
+				const slotProps = {};
+				const slotNames = Object.keys(segment.slots);
+				if (slotNames.length > 0) for (const slotName of slotNames) {
+					const slotNode = segment.slots[slotName];
+					slotProps[slotName] = await buildSlotElement(slotNode, loadModule, createElement, errorBoundaryComponent);
+				}
+				element = createElement(LayoutComponent, {
+					...slotProps,
+					children: element
+				});
+			}
 		}
-		return "{" + parts.join(",") + "}";
 	}
+	return {
+		tree: element,
+		isApiRoute: false
+	};
 }
 /**
-* Canonicalize a single value, or null if it is unkeyable. The ONE
-* definition of "faithfully comparable" — every prebuilt code path that
-* needs value equality (cache keys, slot-param divergence) goes through
-* this, so the unkeyable rules (accessors, hidden props, aliases,
-* bigints, …) live in exactly one place.
+* Build the element tree for a parallel slot.
+*
+* Slots have their own access.ts (SlotAccessGate) and error boundaries.
+* On access denial: denied.tsx → default.tsx → null (graceful degradation).
 */
-function tryCanonicalize(value) {
-	try {
-		return canonicalize$1(value, /* @__PURE__ */ new Set());
-	} catch (error) {
-		return toUnkeyable(error);
+async function buildSlotElement(slotNode, loadModule, createElement, errorBoundaryComponent) {
+	const PageComponent = (slotNode.page ? await loadModule(slotNode.page) : null)?.default;
+	const DefaultComponent = (slotNode.default ? await loadModule(slotNode.default) : null)?.default;
+	if (!PageComponent) return DefaultComponent ? createElement(DefaultComponent, {}) : null;
+	let element = createElement(PageComponent, {});
+	element = await wrapWithErrorBoundaries(slotNode, element, loadModule, createElement, errorBoundaryComponent);
+	if (slotNode.access) {
+		const accessFn = (await loadModule(slotNode.access)).default;
+		const DeniedComponent = (slotNode.denied ? await loadModule(slotNode.denied) : null)?.default ?? null;
+		const defaultFallback = DefaultComponent ? createElement(DefaultComponent, {}) : null;
+		element = createElement("timber:slot-access-gate", {
+			accessFn,
+			DeniedComponent,
+			slotName: slotNode.segmentName.replace(/^@/, ""),
+			createElement,
+			defaultFallback,
+			children: element
+		});
 	}
+	return element;
 }
+/** MDX/markdown extensions — these are server components that cannot be passed as function props. */
+var MDX_EXTENSIONS = /* @__PURE__ */ new Set(["mdx", "md"]);
 /**
-* Totality by construction: ANY throw from the walk means the input is
-* outside the keyable domain. The walk touches only user-controlled
-* values through reflection ops — and a Proxy trap can throw arbitrary
-* errors from any of them (codex review on PR #835) — so converting only
-* UnkeyableValueError would let hostile/exotic inputs abort a render
-* that plain live rendering would have served fine. Unexpected error
-* types are logged for visibility (they would indicate either a proxy
-* trap or a canonicalizer bug) but still degrade to unkeyable.
+* Check if a route file is an MDX/markdown file based on its extension.
+* MDX components are server components by default and cannot cross the
+* RSC→client boundary as function props. They must be pre-rendered as
+* elements and passed as fallbackElement instead of fallbackComponent.
 */
-function toUnkeyable(error) {
-	if (!(error instanceof UnkeyableValueError)) console.error("[timber] cache key canonicalization threw — treating input as unkeyable:", error);
-	return null;
+function isMdxFile(file) {
+	return MDX_EXTENSIONS.has(file.extension);
 }
 /**
-* Split a props record into data props (participate in the cache key) and
-* slot values (React-element holes, excluded from the key) per the
-* component's declared `slots` option (TIM-1173).
+* Wrap an element with error boundaries from a segment's status-code files.
 *
-* Every DECLARED slot lands in `slotValues` — present or not — because the
-* capture render always injects a SlotOutlet placeholder for each declared
-* slot: the cached shell is identical whether the caller passed the slot
-* or omitted it, so slot presence must not vary the key. `dataProps` is
-* everything else and is what gets hashed.
+* Wrapping order (innermost to outermost):
+*   1. Specific status files (503.tsx, 429.tsx, etc.)
+*   2. Category catch-alls (4xx.tsx, 5xx.tsx)
+*   3. error.tsx (general error boundary)
 *
-* Returns null when the props OBJECT itself is outside the identity
-* contract at the top level — accessors, symbol-keyed or non-enumerable
-* properties, or a non-`Object.prototype` prototype. Splitting such an
-* object would normalize away observable state (and reading an accessor
-* would invoke user code, which this walk must never do) BEFORE
-* `computeComponentCacheKey` gets the chance to reject it — a cached
-* shell could then be served for inputs a live render distinguishes.
-* Null means unkeyable: the caller renders live with the original props.
-* The walk is descriptor-reads only; getters are never invoked. Nested
-* data-prop values still face the full allowlist when hashed.
+* This creates the fallback chain described in design/10-error-handling.md.
+*
+* MDX status files are server components and cannot be passed as function
+* props to TimberErrorBoundary (a 'use client' component). Instead, they
+* are pre-rendered as elements and passed as fallbackElement. The error
+* boundary renders the element directly when an error is caught.
+* See TIM-503.
 */
-/** Create an own enumerable data property — safe for keys like `__proto__`. */
-function defineOwn(target, key, value) {
-	Object.defineProperty(target, key, {
-		value,
-		enumerable: true,
-		writable: true,
-		configurable: true
-	});
-}
-function splitSlotProps(props, slots) {
-	try {
-		if (Object.getPrototypeOf(props) !== Object.prototype) return null;
-		if (Object.getOwnPropertySymbols(props).length > 0) return null;
-		const slotSet = new Set(slots);
-		const dataProps = {};
-		const slotValues = {};
-		for (const key of Object.getOwnPropertyNames(props)) {
-			const desc = Object.getOwnPropertyDescriptor(props, key);
-			if (desc === void 0 || desc.get !== void 0 || desc.set !== void 0 || !desc.enumerable) return null;
-			defineOwn(slotSet.has(key) ? slotValues : dataProps, key, desc.value);
+async function wrapWithErrorBoundaries(segment, element, loadModule, createElement, errorBoundaryComponent) {
+	if (segment.statusFiles) {
+		for (const [key, file] of Object.entries(segment.statusFiles)) if (key !== "4xx" && key !== "5xx") {
+			const status = parseInt(key, 10);
+			if (!isNaN(status)) {
+				const mod = await loadModule(file);
+				const Component = isValidElementType(mod.default) ? mod.default : null;
+				if (Component) element = createElement(errorBoundaryComponent, isMdxFile(file) ? {
+					fallbackElement: createElement(Component, { status }),
+					status,
+					children: element
+				} : {
+					fallbackComponent: Component,
+					status,
+					children: element
+				});
+			}
 		}
-		for (const slot of slotSet) if (!Object.hasOwn(slotValues, slot)) defineOwn(slotValues, slot, void 0);
-		return {
-			dataProps,
-			slotValues
-		};
-	} catch (error) {
-		return toUnkeyable(error);
+		for (const [key, file] of Object.entries(segment.statusFiles)) if (key === "4xx" || key === "5xx") {
+			const mod = await loadModule(file);
+			const Component = isValidElementType(mod.default) ? mod.default : null;
+			if (Component) {
+				const categoryStatus = key === "4xx" ? 400 : 500;
+				element = createElement(errorBoundaryComponent, isMdxFile(file) ? {
+					fallbackElement: createElement(Component, {}),
+					status: categoryStatus,
+					children: element
+				} : {
+					fallbackComponent: Component,
+					status: categoryStatus,
+					children: element
+				});
+			}
+		}
+	}
+	if (segment.error) {
+		const errorModule = await loadModule(segment.error);
+		const ErrorComponent = isValidElementType(errorModule.default) ? errorModule.default : null;
+		if (ErrorComponent) element = createElement(errorBoundaryComponent, isMdxFile(segment.error) ? {
+			fallbackElement: createElement(ErrorComponent, {}),
+			children: element
+		} : {
+			fallbackComponent: ErrorComponent,
+			children: element
+		});
 	}
+	return element;
 }
+//#endregion
+//#region src/server/csrf.ts
+/** HTTP methods that are considered safe (no mutation). */
+var SAFE_METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"OPTIONS"
+]);
 /**
-* Compute the cache-entry hash for a component render:
-* `sha256({props, params}).slice(0, 16)` over canonical JSON.
+* Derive the request's scheme from trusted sources.
 *
-* Returns null when props (or params) contain unkeyable values — the
-* caller must fall back to dynamic rendering.
+* Priority:
+* 1. X-Forwarded-Proto (set by reverse proxies / load balancers)
+* 2. Request URL protocol
+*
+* Falls back to 'https' (fail closed) if neither is available.
 */
-function computeComponentCacheKey(props, params) {
-	let canonical;
+function deriveRequestScheme(req) {
+	const forwarded = req.headers.get("X-Forwarded-Proto");
+	if (forwarded) {
+		const proto = forwarded.split(",")[0].trim().toLowerCase();
+		if (proto === "http" || proto === "https") return proto;
+	}
 	try {
-		const seen = /* @__PURE__ */ new Set();
-		canonical = "{\"params\":" + canonicalize$1({ ...params }, seen) + ",\"props\":" + canonicalize$1(props, seen) + "}";
-	} catch (error) {
-		return toUnkeyable(error);
+		return new URL(req.url).protocol.replace(":", "");
+	} catch {
+		return "https";
 	}
-	return createHash("sha256").update(canonical).digest("hex").slice(0, 16);
 }
-//#endregion
-//#region src/client/slot-context.ts
 /**
-* SlotContext — delivers live slot content to SlotOutlet holes inside
-* cached component shells (TIM-1173).
-*
-* A `cache.component(Fn, { slots: [...] })` shell is captured with a
-* stable <SlotOutlet slot={name} /> client reference in place of each
-* declared slot prop. At request time the revived shell is wrapped in a
-* SlotsProvider carrying the live slot values; each outlet reads its
-* value from this context by name.
-*
-* The value is a per-instance record — the NEAREST provider wins, so two
-* instances of the same cached component on one page each resolve their
-* own children, and a slot component nested inside another slot
-* component's children reads its own provider, not the outer one.
-*
-* Generalizes the ChildSegmentContext pattern (TIM-1181) from a single
-* implicit `children` hole on layouts to explicitly declared, named slot
-* props on any cached component.
+* Validate the Origin header against the request's full origin
+* (scheme + host + port).
 *
-* SINGLETON GUARANTEE: globalThis + Symbol.for — the RSC client bundler
-* can duplicate this module across chunks; globalThis guarantees a single
-* context instance. Same pattern as ChildSegmentContext.
+* For mutation methods (POST, PUT, PATCH, DELETE):
+* - If `csrf: false`, skip validation.
+* - If `allowedOrigins` is set, Origin must match one exactly (no wildcards).
+* - Otherwise, Origin must match the derived request origin.
 *
-* See design/45-cache-lifetimes.md §Slot Components.
+* Safe methods (GET, HEAD, OPTIONS) always pass.
 */
-var CTX_KEY = Symbol.for("__timber_slot_ctx");
-function getOrCreateContext() {
-	const existing = globalThis[CTX_KEY];
-	if (existing !== void 0) return existing;
-	if (typeof React.createContext === "function") {
-		const ctx = React.createContext(null);
-		globalThis[CTX_KEY] = ctx;
-		return ctx;
+function validateCsrf(req, config) {
+	if (SAFE_METHODS.has(req.method)) return { ok: true };
+	if (config.csrf === false) return { ok: true };
+	const origin = req.headers.get("Origin");
+	if (!origin) return {
+		ok: false,
+		status: 403
+	};
+	if (config.allowedOrigins) return config.allowedOrigins.includes(origin) ? { ok: true } : {
+		ok: false,
+		status: 403
+	};
+	const host = req.headers.get("Host");
+	if (!host) return {
+		ok: false,
+		status: 403
+	};
+	let originOrigin;
+	try {
+		originOrigin = new URL(origin).origin;
+	} catch {
+		return {
+			ok: false,
+			status: 403
+		};
+	}
+	const scheme = deriveRequestScheme(req);
+	let expectedOrigin;
+	try {
+		expectedOrigin = new URL(`${scheme}://${host}`).origin;
+	} catch {
+		return {
+			ok: false,
+			status: 403
+		};
 	}
+	return originOrigin === expectedOrigin ? { ok: true } : {
+		ok: false,
+		status: 403
+	};
 }
-var SlotContext = getOrCreateContext();
 //#endregion
-//#region src/client/slot-outlet.tsx
+//#region src/server/body-limits.ts
+var KB = 1024;
+var MB = 1024 * KB;
+var GB = 1024 * MB;
+var DEFAULT_LIMITS = {
+	actionBodySize: 1 * MB,
+	uploadBodySize: 10 * MB,
+	maxFields: 100
+};
+var SIZE_PATTERN = /^(\d+(?:\.\d+)?)\s*(kb|mb|gb)?$/i;
+/** Parse a human-readable size string ("1mb", "512kb", "1024") into bytes. */
+function parseBodySize(size) {
+	const match = SIZE_PATTERN.exec(size.trim());
+	if (!match) throw new Error(`Invalid body size format: "${size}". Expected format like "1mb", "512kb", or "1024".`);
+	const value = Number.parseFloat(match[1]);
+	const unit = (match[2] ?? "").toLowerCase();
+	switch (unit) {
+		case "kb": return Math.floor(value * KB);
+		case "mb": return Math.floor(value * MB);
+		case "gb": return Math.floor(value * GB);
+		case "": return Math.floor(value);
+		default: throw new Error(`Unknown size unit: "${unit}"`);
+	}
+}
+/** Strict integer pattern: one or more digits, nothing else. */
+var STRICT_INTEGER_RE = /^\d+$/;
+/** Check whether a request body exceeds the configured size limit (stateless, no ALS). */
+function enforceBodyLimits(req, kind, config) {
+	const contentLength = req.headers.get("Content-Length");
+	if (!contentLength) return {
+		ok: false,
+		status: 411
+	};
+	const trimmed = contentLength.trim();
+	if (!STRICT_INTEGER_RE.test(trimmed)) return {
+		ok: false,
+		status: 411
+	};
+	return Number.parseInt(trimmed, 10) <= resolveLimit(kind, config) ? { ok: true } : {
+		ok: false,
+		status: 413
+	};
+}
 /**
-* SlotOutlet — the hole in a cached component shell (TIM-1173).
-*
-* At capture time the prebuilt runtime renders the wrapped component with
-* <SlotOutlet slot={name} /> in place of each declared slot prop. Being a
-* client component, it serializes into the flight payload as a stable,
-* deterministic client reference — the same bytes regardless of what live
-* content will fill the hole. At request time the revived shell sits under
-* a SlotsProvider and each outlet reads its live value from SlotContext.
-*
-* See design/45-cache-lifetimes.md §Slot Components.
+* Resolve the byte limit for a given body kind, using config overrides or defaults.
 */
-function SlotOutlet({ slot }) {
-	const values = useContext(SlotContext);
-	return values ? values[slot] ?? null : null;
+function resolveLimit(kind, config) {
+	const userLimits = config.limits;
+	if (kind === "action") return userLimits?.actionBodySize ? parseBodySize(userLimits.actionBodySize) : DEFAULT_LIMITS.actionBodySize;
+	return userLimits?.uploadBodySize ? parseBodySize(userLimits.uploadBodySize) : DEFAULT_LIMITS.uploadBodySize;
 }
 //#endregion
-//#region src/client/slot-provider.tsx
+//#region src/server/route-handler.ts
+/** All recognized HTTP method export names. */
+var HTTP_METHODS = [
+	"GET",
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE",
+	"HEAD",
+	"OPTIONS"
+];
 /**
-* SlotsProvider — wraps a revived cached shell to supply live slot content
-* to the SlotOutlet holes inside it (TIM-1173).
-*
-* Tree structure per cached-component instance:
-*   SlotsProvider(values={children: <Live />})
-*     └── revived shell
-*          └── SlotOutlet(slot="children") → reads context → <Live />
+* Resolve the full list of allowed methods for a route module.
 *
-* See design/45-cache-lifetimes.md §Slot Components.
+* Includes:
+* - All explicitly exported methods
+* - HEAD (implicit when GET is exported)
+* - OPTIONS (always implicit)
 */
-function SlotsProvider({ values, children }) {
-	return createElement(SlotContext.Provider, { value: values }, children);
+function resolveAllowedMethods(mod) {
+	const methods = [];
+	for (const method of HTTP_METHODS) {
+		if (method === "HEAD" || method === "OPTIONS") continue;
+		if (mod[method]) methods.push(method);
+	}
+	if (mod.GET && !mod.HEAD) methods.push("HEAD");
+	else if (mod.HEAD) methods.push("HEAD");
+	if (!mod.OPTIONS) methods.push("OPTIONS");
+	else methods.push("OPTIONS");
+	return methods;
 }
-//#endregion
-//#region src/server/prebuilt/slots.ts
 /**
-* Slot-component helpers for cache.component (TIM-1173).
-*
-* A `slots: ['children', ...]` declaration caches the component's output
-* as a shell with a stable <SlotOutlet slot={name} /> client-reference
-* hole per declared slot prop; live slot content composes in per instance
-* at request time via SlotsProvider/SlotContext. This generalizes the
-* TIM-1181 layout mechanism (ChildSegmentOutlet) to explicitly declared,
-* named slots on any cached component.
+* Handle an incoming request against a route.ts module.
 *
-* Both the production wrapper (cache path) and the dev wrapper (no cache,
-* same tree shape for dev/prod parity) build their render from these
-* helpers. See design/45-cache-lifetimes.md §Slot Components.
-*/
-/**
-* Is this value the framework-injected `<ChildSegmentOutlet />` element?
-* Total: the `in` probe and `.type` read run against a user-controlled
-* value, and a Proxy trap can throw — that must classify as "not the
-* outlet" (the canonicalizer then rejects the value as unkeyable → live
-* render), not abort the request (codex P2 on PR #890).
+* Dispatches to the named method handler, auto-generates 405/OPTIONS,
+* and merges response headers from ctx.headers.
 */
-function isChildSegmentOutletElement(value) {
-	try {
-		return value != null && typeof value === "object" && "type" in value && value.type === ChildSegmentOutlet;
-	} catch {
-		return false;
+async function handleRouteRequest(mod, ctx) {
+	const method = ctx.req.method.toUpperCase();
+	const allowHeader = resolveAllowedMethods(mod).join(", ");
+	if (method === "OPTIONS") {
+		if (mod.OPTIONS) return runHandler(mod.OPTIONS, ctx);
+		return new Response(null, {
+			status: 204,
+			headers: { Allow: allowHeader }
+		});
+	}
+	if (method === "HEAD") {
+		if (mod.HEAD) return runHandler(mod.HEAD, ctx);
+		if (mod.GET) {
+			const res = await runHandler(mod.GET, ctx);
+			return new Response(null, {
+				status: res.status,
+				headers: res.headers
+			});
+		}
 	}
+	const handler = mod[method];
+	if (!handler) return new Response(null, {
+		status: 405,
+		headers: { Allow: allowHeader }
+	});
+	return runHandler(handler, ctx);
 }
 /**
-* Dense array of non-empty strings — no holes, no non-string entries.
-* Total: the reads run against a user-controlled value at module load,
-* and a throwing Proxy trap must classify as invalid, not crash startup.
+* Run a handler, merge ctx.headers into the response, and catch errors.
 */
-function isDenseStringArray(value) {
+async function runHandler(handler, ctx) {
 	try {
-		if (!Array.isArray(value)) return false;
-		for (let i = 0; i < value.length; i++) {
-			if (!Object.hasOwn(value, i)) return false;
-			const entry = value[i];
-			if (typeof entry !== "string" || entry.length === 0) return false;
-		}
-		return true;
-	} catch {
-		return false;
+		return mergeResponseHeaders(await handler(ctx), ctx.headers);
+	} catch (error) {
+		if (error instanceof DenySignal || error instanceof RedirectSignal) throw error;
+		logRouteError({
+			method: ctx.req.method,
+			path: new URL(ctx.req.url).pathname,
+			error
+		});
+		return new Response(null, { status: 500 });
 	}
 }
 /**
-* Validate the `slots` option. Both the production and dev wrappers gate
-* on this — slot substitution is active in dev exactly when it would be
-* active in production, so the tree shape a component sees never
-* diverges between the two.
+* Merge response headers from ctx.headers into the handler's response.
+* ctx.headers (set by middleware or the handler) are applied to the final response.
+* Handler-set headers take precedence over ctx.headers.
 */
-function resolveSlotNames(id, options) {
-	const slots = options.slots;
-	if (slots === void 0) return { kind: "none" };
-	if (!isDenseStringArray(slots)) {
-		console.warn(`[timber] cache.component "${id}": invalid slots declaration — expected an array of non-empty prop-name strings. Slot caching is disabled.`);
-		return { kind: "disabled" };
-	}
-	if (slots.length === 0) return { kind: "none" };
-	if (!(options.ttl !== void 0 || options.tags != null)) {
-		console.warn(`[timber] cache.component "${id}": slots require a runtime lifetime (ttl and/or tags). Slot caching is disabled.`);
-		return { kind: "disabled" };
-	}
-	return {
-		kind: "active",
-		slots
-	};
+function mergeResponseHeaders(res, ctxHeaders) {
+	let hasCtxHeaders = false;
+	ctxHeaders.forEach(() => {
+		hasCtxHeaders = true;
+	});
+	if (!hasCtxHeaders) return res;
+	const merged = new Headers();
+	ctxHeaders.forEach((value, key) => {
+		if (key.toLowerCase() === "set-cookie") merged.append(key, value);
+		else merged.set(key, value);
+	});
+	const resCookies = res.headers.getSetCookie();
+	for (const cookie of resCookies) merged.append("Set-Cookie", cookie);
+	res.headers.forEach((value, key) => {
+		if (key.toLowerCase() !== "set-cookie") merged.set(key, value);
+	});
+	return new Response(res.body, {
+		status: res.status,
+		statusText: res.statusText,
+		headers: merged
+	});
 }
+//#endregion
+//#region src/server/render-timeout.ts
 /**
-* Split the live props into the cacheable shell render (data props plus a
-* deterministic SlotOutlet placeholder per declared slot — identical
-* whether or not the caller passed the slot) and the per-instance live
-* slot values.
+* Render timeout utilities for SSR streaming pipeline.
 *
-* Null when the props object itself is unkeyable at the top level
-* (accessors, hidden properties, exotic prototype — see splitSlotProps):
-* the caller must render live with the original props.
+* Provides a RenderTimeoutError class and a helper to create
+* timeout-guarded AbortSignals. Used to defend against hung RSC
+* streams and infinite SSR renders.
+*
+* Design doc: 02-rendering-pipeline.md §"Streaming Constraints"
 */
-function prepareSlotRender(props, slots) {
-	const split = splitSlotProps(props ?? {}, slots);
-	if (split === null) return null;
-	const { dataProps, slotValues } = split;
-	const shellProps = { ...dataProps };
-	for (const slot of slots) Object.defineProperty(shellProps, slot, {
-		value: createElement(SlotOutlet, { slot }),
-		enumerable: true,
-		writable: true,
-		configurable: true
-	});
-	return {
-		shellProps,
-		dataProps,
-		slotValues
-	};
-}
 /**
-* Wrap a rendered shell (revived payload or live element) in a
-* per-instance SlotsProvider feeding the live values to its outlets.
+* Error thrown when an SSR render or RSC stream read exceeds the
+* configured timeout. Callers can check `instanceof RenderTimeoutError`
+* to distinguish timeout from other errors and return a 504 or close
+* the connection cleanly.
 */
-function wrapInSlotsProvider(shell, slotValues) {
-	return createElement(SlotsProvider, {
-		values: slotValues,
-		children: shell
-	});
-}
+var RenderTimeoutError = class extends Error {
+	timeoutMs;
+	constructor(timeoutMs, context) {
+		const message = context ? `Render timeout after ${timeoutMs}ms: ${context}` : `Render timeout after ${timeoutMs}ms`;
+		super(message);
+		this.name = "RenderTimeoutError";
+		this.timeoutMs = timeoutMs;
+	}
+};
 //#endregion
 //#region src/server/prebuilt/key-discipline.ts
 /** Components already warned — exported so tests can reset between cases. */
@@ -3609,7 +3556,7 @@ function resolveKeyParams(store) {
 * exactly when production would serve the cache path rather than the
 * live fallback (dev/prod parity, codex P2 on PR #890): requires an ALS
 * store, keyable params (slot-param divergence unkeys), and keyable data
-* props (after the ChildSegmentOutlet strip).
+* props (after the children slot outlet strip).
 */
 function isSlotRenderKeyable(dataProps) {
 	const store = requestContextAls.getStore();
@@ -3617,7 +3564,7 @@ function isSlotRenderKeyable(dataProps) {
 	const keyParams = resolveKeyParams(store);
 	if (keyParams === null) return false;
 	let keyProps = dataProps;
-	if (isChildSegmentOutletElement(keyProps.children)) {
+	if (isChildrenSlotOutletElement(keyProps.children)) {
 		const { children: _children, ...rest } = keyProps;
 		keyProps = rest;
 	}
@@ -3824,7 +3771,7 @@ async function tryRevivePayload(id, options, props, keyPropsOverride) {
 	const keyParams = (options.prerender ? await isParamIndependent(id) : false) ? {} : resolveKeyParams(store);
 	if (keyParams === null) return null;
 	let keyProps = keyPropsOverride ?? props ?? {};
-	if (isChildSegmentOutletElement(keyProps.children)) {
+	if (isChildrenSlotOutletElement(keyProps.children)) {
 		const { children: _children, ...rest } = keyProps;
 		keyProps = rest;
 	}